We received a response from support@vapi.ai but need clarification on several points before we can share with our client's legal counsel. These items conflict between the email response, your Terms of Service, and your public documentation: 1. Model training opt-out — Your ToS states that with hipaaEnabled: false, customers grant Vapi the right to use call data for model training. Your support team told us the opposite ("not used by default"). Which is accurate? We need this in writing. 2. Standard tier retention — We were told 14-day call retention on PAYG. This isn't documented in your ToS or public docs. Where is this specified? 3. HIPAA mode — We were told 7-90 day auto-deletion. Your docs say HIPAA mode stores nothing at all. Which is correct? Is there an additional cost? 4. Zero Data Retention — Is this the same as HIPAA mode or a separate config? Where is it documented? 5. DPA execution — Available on our current plan or enterprise-only? We've also emailed these questions back to support. This is blocking a signed deal — our client's attorney needs verified answers. Any help expediting would be appreciated.

HIPPA costs $1000 in VAPI, if u pay, ZDR will be implemented