Sub-processors
Last updated August 2026
To answer your calls and messages we use other companies. Where they handle personal data on our behalf they are our sub-processors, and under our processor terms you have authorised the ones on this page. This is the whole list. If a company is not here, it does not handle your data.
Running the service
These are engaged for every business. Between them they carry your account, your customers' details, and the content of the calls and messages we handle for you.
| Provider | What it does | Data it touches | Where, and on what basis |
|---|---|---|---|
| OpenAI | What it doesRuns the AI that speaks on calls, drafts replies to messages, and reads your website into the knowledge base. | Data it touchesLive call audio, call transcripts, message content, and the business details we put in the prompt. | Where, and on what basisUnited States.UK Addendum to the EU Standard Contractual Clauses. |
| Twilio | What it doesConnects the phone calls and sends the text messages. | Data it touchesCaller and recipient phone numbers, call audio while the call is connected, and text message content. | Where, and on what basisUnited States.UK Addendum to the EU Standard Contractual Clauses. |
| Supabase | What it doesStores everything the product holds, and signs you in. | Data it touchesAccounts, business settings, contacts, call transcripts, messages, bookings and uploaded photos. | Where, and on what basisIreland (eu-west-1). Supabase is a US company, so its staff can reach the database to support it.UK Addendum to the EU Standard Contractual Clauses. |
| Vercel | What it doesHosts and serves the website and your dashboard. | Data it touchesWhatever is in a web request: IP address, the pages requested, and dashboard data in transit. | Where, and on what basisDublin, Ireland (dub1). Vercel is a US company.UK Addendum to the EU Standard Contractual Clauses. |
| Fly.io | What it doesRuns the voice service that answers calls and handles messages. | Data it touchesCall audio and transcripts in transit, message content, and booking details. | Where, and on what basisLondon, United Kingdom (lhr). Fly.io is a US company.UK Addendum to the EU Standard Contractual Clauses. |
| Zernio | What it doesThe single connection to your social and WhatsApp accounts: publishing posts, and the shared inbox for DMs and comments. | Data it touchesPosts and media you publish, and DM and comment threads including sender names, handles and WhatsApp numbers. | Where, and on what basisNot yet confirmed by the provider. See the note below this table.Treated as an international transfer until we have confirmed it. |
| Firecrawl | What it doesReads your own public website so the AI knows your services, prices and hours. | Data it touchesThe public content of the website address you give us. | Where, and on what basisUnited States.UK Addendum to the EU Standard Contractual Clauses. |
| Stripe | What it doesTakes your subscription payment. | Data it touchesYour billing contact and card details, which go straight to Stripe. Your customers' data is never sent to Stripe. | Where, and on what basisUnited States.UK Addendum to the EU Standard Contractual Clauses. |
On Zernio. Zernio is the single seam to Instagram, Facebook, TikTok, LinkedIn and WhatsApp, so we never hold your social passwords or touch those platforms directly. Zernio has not published which country it processes in. We would rather say that plainly than print a guess, so we treat it as an international transfer and we are asking them to confirm it.
On the platforms themselves. When we publish a post or send a reply, the content goes to the platform your account is on. Those platforms handle it under the terms you already have with them, as your own providers rather than ours.
Only when you connect them
These do nothing until you connect the service yourself. You already have your own account and your own agreement with each one, so we are passing data to a system you chose, at your instruction.
| Provider | What it does | Data it touches | Where, and on what basis |
|---|---|---|---|
| Google Calendar | What it doesReads your busy times and writes the booking into your diary. | Data it touchesAppointment time, title and description, and the customer's email address as an attendee. | Where, and on what basisUnited States.Your own agreement with Google for your calendar. |
| Savvy Pet Spa | What it doesCreates the booking in your Savvy diary through your public booking link. | Data it touchesCustomer name and contact details, pet details, the service and the time. | Where, and on what basisNot confirmed by the provider.Your own agreement with Savvy. |
| ElevenLabs and Deepgram | What it doesOnly where a business uses a custom cloned voice: Deepgram turns the caller's speech into text and ElevenLabs speaks the reply, inside Twilio's relay. | Data it touchesCall audio. | Where, and on what basisUnited States.UK Addendum to the EU Standard Contractual Clauses. |
This website
These two see marketing pages only, and only after you accept cookies. Neither ever loads on the dashboard, on onboarding or on sign-in, because those pages can show your customers' personal data and your customers never agreed to that. The detail is on our cookie page.
| Provider | What it does | Data it touches | Where, and on what basis |
|---|---|---|---|
| Google Analytics | What it doesCounts visits to the marketing pages so we can see what is useful. | Data it touchesPages viewed, approximate location from your IP address, device and browser. | Where, and on what basisUnited States.UK Addendum to the EU Standard Contractual Clauses. |
| Microsoft Clarity | What it doesShows how the marketing pages are used, including a replay of the page as your browser drew it. | Data it touchesPages viewed, clicks, scrolling, and the rendered page. | Where, and on what basisUnited States.UK Addendum to the EU Standard Contractual Clauses. |
Where the data sits
Your database is in Ireland, the voice service runs in London, and the website is served from Dublin. Some of the providers above are in the United States. For those we rely on the UK Addendum to the EU Standard Contractual Clauses in that provider's data processing terms. Where a provider has told us nothing about where it processes, the table says so rather than assuming.
If this list changes
If we add or replace a sub-processor that handles your customers' data, we will update this page and email the owner on your account at least 30 days before the change takes effect, so you have time to look at it. If you object and we cannot resolve it between us, you can end your plan without penalty. Removing a sub-processor needs no notice.
Contact
Questions about anything here, including for a vendor review, go to CallsPicked · hello@callspicked.com. Our processor terms are in the Terms of Service, and what we do with your own account data is in the Privacy Policy.