| Company | Purpose | Data it receives | Location |
|---|---|---|---|
| Hetzner Online GmbH | Hosting: our servers, database and recording storage | Everything in your account, at rest | EU |
| Cloudflare, Inc. | DNS, encryption (TLS) and network protection in front of the app and this website | Everything between your browser and us, in transit: pages, recordings as they play, transcripts and sign-in cookies | Global network (US company) |
| AssemblyAI, Inc. | Transcription, Standard engine | The audio of a call; returns the transcript | EU region (US company) |
| Deepgram, Inc. | Transcription, Precise engine | The audio of a call; returns the transcript | US |
| OpenRouter, Inc. | Routes each AI request to the model that answers it | Transcript text, after any redaction your workspace has switched on. When you connect a Google Sheet, up to 20 sample rows so its columns can be matched. For Ask, the call details it looks up, which can include caller names and numbers | US |
| OpenAI, or Microsoft Azure (through OpenRouter) | The AI models that read calls, write summaries and answer Ask | The same as OpenRouter, for the request being answered | US |
| Brevo (Sendinblue SAS) | Account email: sign-in and verification links, alerts and digests | The recipient’s email address and the message, which can include call summaries | EU (France) |
| Resend, Inc. | Backup email provider, used only if we switch to it | The same as Brevo | US |
| Stripe, Inc. | Card payments and invoices | Billing email, plan and payment details. Card numbers go straight to Stripe; we never see them | US |
| Google (only if you connect it) | The Drive and Sheets connectors | We read only the files and sheets you choose, using the Google account you connect. This is your own connection, under your agreement with Google | Set by your Google account |
Transcription and AI providers receive a call’s audio or transcript only to process it, and their own retention terms apply. Some of them are in the US, so audio and transcripts leave the EU to be processed. The Data Processing Agreement covers how those transfers are protected.
Services you connect yourself, such as Slack, Telegram or a webhook, receive what you choose to send them. They act for you, not for us, so they are not on this list.
How we tell you about changes
We email every account owner, and everyone who has accepted our DPA, at least 30 days before we add or replace a subprocessor. If you object, reply to that email and tell us why. If we can’t resolve it, you can close your account before the change takes effect.
Don’t have an account yet but want to hear about changes? Email [email protected].