This list is part of the Data Processing Addendum (DPA) and the Privacy Policy. It covers the providers involved in the service, checked against the platform's code. Last verified: October 24, 2026.
1. How to read this list
- A. SalesMarketing subprocessors: providers we engage, under our own account, that process data of our users, of our Customers' end customers, or both.
- B. Integrations the Customer connects: services the Customer chooses to connect with its own account. They are the Customer's providers under its own contract, not our subprocessors; SalesMarketing sends or reads data there on the Customer's instructions.
- C. Public website and dashboard: measurement and session-recording tools on our own website and dashboard, which only run with consent.
- When the Customer uses its own key for a provider in table A, that provider processes the data under the Customer's contract with it.
- Location shows where the provider is or where it processes data according to the information available; "to be confirmed" means we have not verified it yet.
2. A. SalesMarketing subprocessors
| Provider | Role in the platform | Personal data | Whose data | Location | When it is used |
|---|---|---|---|---|---|
| Railway Corporation | Hosting of the application, database, queues and the QR messaging service | All platform data: accounts, CRM, messages, transcripts, encrypted tokens, IP and logs | Users and end customers | U.S. | Always |
| Railway Corporation (object storage) | Creatives and media, plus a separate private store for call and meeting recordings | Media files, call and meeting audio | Users and end customers | U.S. | Always |
| Stripe, Inc. | Billing for SalesMarketing plans and balance | Email, customer ID, plan and payment history; card data is held by Stripe | Users | U.S. | When subscribing to a plan or buying balance |
| Resend (Plus Five Five, Inc.) | Sending platform email and the Customer's campaigns | Email, name, message content and delivery events | Users and end customers | U.S. | Whenever email is sent |
| Functional Software, Inc. (Sentry) | Server and screen error logging | Technical traces with personal data scrubbed, IP | Users | U.S. | Always |
| Twilio Inc. | Telephony (numbers, calls, recording, in-browser phone) and WhatsApp | Phone numbers, call audio, WhatsApp content and attachments, names | End customers and users | U.S. | If the Customer turns on telephony or connects WhatsApp |
| Vapi, Inc. | AI voice agent during calls (does not record) | Real-time audio and transcript, phone number, script | End customers | U.S. | If the Customer creates and turns on a voice agent |
| Deepgram, Inc. (through Vapi) | Speech to text inside the voice agent | Call audio | End customers | U.S. | Together with the voice agent |
| Google LLC (Gemini API) | Artificial intelligence: copy, images, video, chat, summaries and default transcription of calls and meetings | Prompts with CRM data, audio, transcripts, messages, images and brand content | Users and end customers | U.S. | Always |
| TypeSafe (api.typesafe.ai) | Closed-choice decision classifier: message type, WhatsApp category, objections, chat routing and website assistant | Snippets of messages and conversations, public brand profile | Users and end customers | To be confirmed | Always |
| Fish Audio | Voice cloning and synthetic voice | Voice samples, scripts, name | Users and people who provide their voice | To be confirmed | Only if the Customer clones a voice with consent |
| HeyGen Technology Inc. | Video avatars and digital twins | Person's likeness and voice, scripts | Users and people who provide their likeness | U.S. | Only if the Customer creates an avatar or twin with consent |
| Firecrawl (Mendable, Inc.) | Reading websites, searches and SEO rankings | URLs and public web content, with only incidental personal data | Users and third parties | U.S. | In SEO, brand DNA and radar features |
| Apify Technologies s.r.o. | Reading competitors' public profiles and ad libraries | Public profile data of third parties | Third parties | U.S. and EU | In the market radar |
| OpenAI, L.L.C. | Measuring brand presence in AI assistants (GEO); transcription only if the Customer uses its own key | Questions about the brand; call and meeting audio only with the Customer's key | Users; end customers only with own key | U.S. | In GEO measurement or with own key |
| Anthropic, PBC | GEO measurement only | Questions about the brand, no personal data expected | Users | U.S. | In GEO measurement |
| Perplexity AI, Inc. | GEO measurement only | Questions about the brand, no personal data expected | Users | U.S. | In GEO measurement |
| Microsoft Corporation (fallback voice) | Synthetic narration of short videos when no other voice is available | Video script | Users | Global | Only as a fallback |
3. B. Integrations the Customer connects
These services are involved only if the Customer connects them with its own account. The Customer contracts with them and is responsible for their terms.
| Service | What it is connected for | Data that flows |
|---|---|---|
| Meta (ads, Conversions API, pixel on the Customer's website, WhatsApp, Instagram, Messenger) | Ads, audiences, conversions and messaging | Email and phone hashed with SHA-256, events, messages |
| WhatsApp via QR code | The Customer's WhatsApp session | Message content and phone numbers |
| TikTok (ads, pixel, shop) | Ads, audiences and catalog | Hashed email and phone, events |
| Google (ads, Gmail, Drive, Calendar, Meet, Business Profile, Analytics, Tag Manager, Search Console) | Conversions, email, calendar, meeting recordings, SEO | Hashed email, email content, recordings and transcripts |
| Microsoft (Outlook, Calendar, OneDrive, Teams) | Email, calendar and meeting recordings | Emails, events, recordings |
| Microsoft Clarity (the Customer's project on its website) | Session recording on the Customer's website, with the visitor's consent | Visitor behavior and IP |
| LinkedIn (ads) | Conversions and audiences | Hashed email |
| ChatGPT Ads (OpenAI) | Ads | Identifiers and events |
| Zoom | Meetings and webinars | Attendees and recordings |
| Stripe Connect | The business charging its own customers through payment links | Buyers' payment data and email |
| Apollo (with the Customer's key) | Company prospecting | Third parties' name, job title and work email |
| HubSpot, Salesforce, Zoho | External CRM | Contacts and deals |
| Shopify, WooCommerce, Mercado Libre, AliExpress, TikTok Shop | Catalog and orders | Orders and buyers |
| Own keys (AI, voice, web reading, radar) | The Customer uses its own account with a provider in table A | Those in table A for that provider |
4. C. Public website and dashboard
| Provider | Where | Purpose | When |
|---|---|---|---|
| Google (Analytics and Google Ads tag) | Public website | Measuring our own marketing | Only with analytics or marketing consent |
| Meta (pixel) | Public website | Measuring our own marketing | Only with marketing consent |
| TikTok (pixel) | Public website | Measuring our own marketing | Only with marketing consent |
| Microsoft Clarity | Public website and dashboard | Session recording to improve the experience | On the website, only with analytics consent; in the dashboard, only if the user turns it on in Settings, with all text masked and nobody identified |
| Functional Software, Inc. (Sentry) | Public website and dashboard | Screen errors | Always, without personal data by default |
Fonts are served from our own domain. More detail in the Cookie Policy.
5. Changes and notices
- We will give notice of any new or replaced subprocessor in table A at least 30 days in advance, on this page and by email.
- To receive notices by email, write to {CORREO_LEGAL} with the subject "Subprocessor subscription".
- The Customer may object within that period under section 10 of the DPA.
- Changes are recorded in the version log.
6. Retired providers
They are no longer involved in the service and receive no new data: SendGrid, Amazon SES and fallback SMTP servers (email), Unipile (LinkedIn messaging), Kapso (WhatsApp), SerpAPI and DataForSEO (SEO) and Tiendanube (store).