Sub-Processors

Purpose: Application hosting, edge runtime, serverless function execution for the marketing site, operator portal, and webhook endpoints.

Data: All Operator and End-User data passes through Vercel in-memory during request handling.

Purpose: Managed Postgres database for Operator account data, encrypted OAuth tokens, knowledge-base content, conversation history, and integration cache.

Data: Persistent storage of Operator and End-User personal data.

Purpose: Managed Redis used for rate-limiting and ephemeral session state.

Data: IP addresses, request fingerprints (short-lived, typically minutes).

Purpose: Large language model API for chatbot replies, voice responses, outbound email drafting, content generation, SEO recommendations, and similar AI features.

Data: Targeted feature inputs only — Operator brand context, KB excerpts, current conversation fragment, the specific item the AI is asked to draft. Not used to train Anthropic models.

Purpose: Inbound and outbound voice telephony, voice recording, transcription, SMS delivery, A2P 10DLC campaign registration.

Data: Caller phone numbers, call audio and transcripts, SMS message content, delivery metadata.

Purpose: Outbound email delivery for AI Prospector and AI Loyalty Manager campaigns.

Data: Recipient email and name, message content, delivery and engagement metadata (sent, delivered, opened, clicked, replied, bounced, unsubscribed).

Purpose: Transactional email — contact-form replies from the marketing site, account notifications, billing receipts, security alerts.

Data: Recipient email, message content, delivery metadata.

Purpose: Subscription billing, payment-method storage, invoicing, tax calculation, fraud screening.

Data: Operator billing identifiers, payment-method metadata (Stripe holds the card; we hold a token), invoice history. We do not store full card numbers.

Purpose: GBP post publishing, Search Console rank tracking and SEO insights, on behalf of the connecting Operator. See Privacy Policy § 11 for full disclosure.

Data: Encrypted OAuth tokens; cached rankings, audit results, and recommendations.

Purpose: Posting Operator-approved content to the Operator's LinkedIn page, when connected.

Data: Encrypted OAuth tokens; post content as authored or approved by the Operator.

Purpose: Native CRM sync — lead push, status updates, and conversation logs, when connected.

Data: OAuth credentials; lead contact details and conversation summaries.

Purpose: Routing leads and events to Operator-selected destinations (other CRMs, scheduling tools, ops tools), when connected.

Data: Webhook payloads containing lead data the Operator routes through Zapier.