Subprocessors
Effective: September 5, 2026
These vendors handle Client Data to help us deliver the Services. Each is bound by written terms covering confidentiality and security.
| Subprocessor | What they do for you | Client Data they receive |
|---|---|---|
| Supabase, Inc. | Database and authentication for our platform and your client portal | Lead records, call transcripts, consent records, portal login credentials |
| Cloudflare, Inc. | Hosting, security, bot protection, and delivery for your landing pages and our systems | Form submissions in transit, visitor IP addresses for security |
| Stripe, Inc. | Payment processing for your Retainer and Ad Budget deposits | Your business payment details (never seen by us) |
| Resend, Inc. | Sending email (review requests, reactivation emails, reports, notifications) | Recipient names and email addresses, message content |
| Telnyx LLC | Telephone numbers, call routing, call recording and transcription where Exhibit A permits it, SMS delivery (SMS only after C8 authorization) | Caller and recipient phone numbers, call metadata, recordings and transcripts of recorded calls, SMS content |
| ElevenLabs, Inc. | Voice AI that lets ELIAS speak and listen on calls; holds call audio | Caller voice audio and transcripts for calls ELIAS handles |
| Anthropic, PBC | AI model provider for ELIAS's reasoning, drafting, and chat | Text we send for processing: lead details, transcripts, your business information |
| OpenAI, L.L.C. | Backup AI processing and semantic search over our internal notes; image generation fallback | Text we send for processing; creative briefs |
| Google LLC (Gemini API) | AI image generation for your ad and post creative | Creative briefs, brand descriptions |
| Telegram | Internal real-time notifications to a Supervisor about your account | Business name and a lead alert (source, time, and service requested). No caller names or phone numbers. |
| Google Workspace (Google LLC) | Hosting for our business mailboxes (support@, info@) | Emails you send us, and their attachments |
| DataForSEO | Ranking, GBP, and on-page data for reporting | Your public business name, address, and website URL (no customer data) |
| Perplexity AI, Inc. | AI search visibility monitoring (Exhibit A, Section A12) | The agreed buyer prompts, which may include your public business name and service area; the assistant's answer and cited sources. No lead, caller, or customer data. |
| Sentry | Error monitoring for our software | Technical error data; configured not to attach personal data |
| Cal.com, Inc. | Scheduling strategy calls | Your name, email, and the answers you type when booking |
AI providers
Under the commercial terms we have accepted, Anthropic, OpenAI, and Google (paid API tier) do not use the content we send them to train their models. They may retain content for a short period for abuse monitoring under their terms. We do not claim zero retention by any AI provider.
Advertising platforms
Google Ads and Meta are not our subprocessors. Your ads run in ad accounts that you own, and the platforms process data there under their own terms as your service providers (Exhibit B). We reach your accounts through our manager account and our own platform credentials so that we can build and manage your campaigns and pay for them from your Ad Budget. What we send the platforms: your ad copy, images, landing page URLs, targeting parameters, budget instructions, and the conversion signals your landing pages generate (for example, that a form was submitted). What we read back: spend, delivery, and performance data for your campaigns, which we use for your dashboard, your Ad Budget statement, and your reports. We do not send the platforms your lead or caller records, and we do not upload customer or lead lists for custom or lookalike audiences unless you instruct us in writing and confirm you have the consent or other lawful basis to do so. Conversion tags on landing pages we host send visitor interactions to your ad accounts; your landing-page privacy notice must say so (Section C12).
Changes
We may add or replace a subprocessor. We post the current list in your client portal and email you at least fifteen (15) days before a new subprocessor handles Client Data, or an existing one begins handling a new category of it. If you object on reasonable data-protection grounds and we cannot resolve it, you may end the Agreement on written notice without the Early Exit Fee in Agreement Section 3.3 applying to that termination.
Change log
| Posted | Subprocessor | Change | Effective |
|---|---|---|---|
| September 5, 2026 | Initial list (Exhibit C4, Rev 7): 15 subprocessors | Added | September 5, 2026 |
How we handle personal information more broadly is in our Privacy Policy.