Vocalyy
Talk to us Talk to us

List of Sub-processors

Version 1.0 — updated May 8, 2026

In compliance with GDPR Article 28, we publish the complete list of sub-processors that Vocalyy SRL uses to deliver our service. All sub-processors have signed data processing agreements (DPAs) with us and comply with GDPR requirements.

What is a sub-processor? A third party that processes personal data on our behalf so we can deliver the AI voice agent service. For example, OpenAI processes your voice to transform it into text and generate the AI response.

Active sub-processors

Vendor Service Data types Location Transfer mechanism
OpenAI, L.L.C. AI model (STT, LLM, TTS) — Realtime API Call audio, transcripts, conversation content USA DPF certified
Anthropic PBC LLM model (Claude — optional fallback) Conversation transcripts USA DPF certified
Telnyx LLC PSTN telephony + Media Streaming Phone number, call audio, metadata USA (EU residency optional) DPF certified
Supabase Inc. PostgreSQL database + Auth User data, contacts, appointments, transcripts EU (Frankfurt, Germany) Within EU — no transfer
Render Services, Inc. Backend application hosting Application logs, active sessions USA DPF certified
Resend (Plus Five Five Inc.) Transactional email Email, notification content USA SCC / DPF
Cal.com Inc. Online scheduling (calendar) Email, name, appointments EU / USA SCC / DPF
Stripe Payments Europe Ltd. Payment processing Billing email, payment data (managed by Stripe) EU (Ireland) Within EU — no transfer
Google LLC Google Workspace (Calendar OAuth integration) OAuth tokens, calendar events (when enabled) USA DPF certified
SmartBill SRL Romanian-compliant invoicing Customer billing data (Tax ID, address) Romania Within EU — no transfer

Sub-processors under evaluation

These are vendors we're evaluating for future integration. They do not process personal data at this time.

  • Microsoft Azure — for EU data residency for customers who request it (planned)
  • HubSpot — CRM integration (on customer request)
  • Twilio — alternative telephony (under evaluation as backup)

How we handle international transfers

For each sub-processor located outside the European Economic Area (EEA), we use one of the following legal mechanisms:

  • EU-US Data Privacy Framework (DPF) — for certified US sub-processors (OpenAI, Anthropic, Telnyx, Render, Google)
  • Standard Contractual Clauses (SCC) — approved by the European Commission, for others
  • Transfer Impact Assessments (TIA) — for higher-risk cases

Change notification

We will notify all our customers at least 30 days in advance of adding any new sub-processor. Customers have the right to object and to terminate the contract without penalty if they disagree with a significant change.

Notification is done via:

  • Email to each customer's primary contact
  • Update on this page
  • Dashboard notification

How to object

If you're a Vocalyy B2B customer and object to the addition of a new sub-processor, write to us at dpo@vocalyy.ro within 30 days of notification. We will find an alternative solution or, if not possible, you may terminate the contract without penalty.

Contact

For questions about sub-processors or data processing:

This page is part of our transparency policy. See also: Privacy Policy · Terms and Conditions · Retention Policy · AI System Information