Sub-processors

A sub-processor is a third party that processes personal data on our behalf while we provide the Services. This list is the one referred to in our Privacy Policy and Data Processing Agreement. Each entry names the service, what we use it for, and the categories of personal data it receives.

We give 30 days' written notice (via email and dashboard banner) before adding or replacing a sub-processor. Your right to object is set out in section 4 of the Data Processing Agreement.

These services run, store, or back up the calls you place and the contact lists you upload, so they process personal data of the people your agent calls.

• Exotel — Telephone carrier that places and receives calls on our numbers and streams their audio to our voice runtime. Data: Phone numbers of the people your agent calls or who call you, call audio while the call is live, and call records (times, durations, status).
• Fly.io — Hosts our voice runtime, which runs each conversation between the phone line and the speech and language models. Data: Call audio and the text of the conversation while the call is live, the call recording before it is stored, and your agent's prompt and settings. Location: Mumbai, India.
• Supabase — Managed Postgres database that stores the application's records, and the storage that holds call recordings. Data: Account, organisation and billing records; contact lists, call records, redacted transcripts and call recordings for the people your agent calls; business-verification details you submit.
• Vercel — Hosts the website, dashboard, API and background jobs, and stores the business-verification documents you upload. Data: All application data while it is being processed, including contact and call data; request logs; PAN card, GSTIN certificate and promoter ID documents.
• Inngest — Background job queue that dispatches campaigns, sets up calls and runs scheduled tasks. Data: Job payloads and step results, including the phone numbers and names of the people being called, call IDs and account email addresses.
• GitHub — Runs the nightly database backup and stores each backup for 30 days. Data: A copy of the application database, covering the records described under Supabase.

Our own voice runtime, hosted on Fly.io (listed above), connects each call to the providers below using the configuration we set for your agent. They receive call audio or conversation text for the people your agent calls.

• OpenAI — Language model that writes the agent's replies during a call, and summarises the call afterwards. Data: Your agent's prompt and the text of the conversation. The after-call summary is made from the transcript with phone numbers and other identifiers already redacted. Location: United States.
• Sarvam AI — Speech-to-text and text-to-speech during calls, in Hindi, English and other Indian languages. Data: Audio of the person speaking on the call, and the text of the agent's replies, which can include details from the conversation.

These services handle data about you and your team rather than the people your agent calls.

• Clerk — Sign-in, sessions, team invitations and organisation membership. Data: Names, email addresses, sign-in credentials and MFA factors of you and your team.
• Razorpay — Payments for plans and credit packs. Data: Organisation name, billing email address and payment amounts. Card and UPI details are entered directly with Razorpay and never reach our servers.
• Resend — Transactional email, contact-form messages and the newsletter. Data: Names, email addresses, organisation name and message content; contact-form submissions and newsletter sign-ups.
• PostHog — Product analytics for the website and dashboard. Data: Page views and product events, browser and device details, IP address, a pseudonymous identifier stored in a cookie, how you first reached our site (campaign tags, referring site, landing page), the email address used to sign up, and your workspace's name. Location: EU.
• Google Analytics (Google LLC) — Website analytics: where visitors come from and which pages they view. Data: Page views and sign-up milestones, browser and device details, IP address (used by Google to estimate location), and a pseudonymous identifier stored in a cookie. No names, email addresses or call data.
• Sentry — Error monitoring. Data: Error reports: stack traces, request details, and browser and device information. Error text can occasionally include data from the request that failed.
• Pusher — Live updates in the dashboard. Data: Organisation, campaign and call identifiers and call status changes.
• Setu — Checks your GSTIN against the GST registry during onboarding. Data: Your organisation's GSTIN and the registration details the registry returns.

If you connect your own Exotel, Twilio, or Plivo account, calls run on that account under your own agreement with the carrier, so the carrier is your processor rather than ours. We store the credentials you give us encrypted and use them to connect your account.

Questions about this list, or an objection to a new sub-processor, go to dpo@cualify.in.