These are the companies that process personal data of our customers' callers and users on Vorelai's behalf. We have a data processing agreement with each. We tell customers at least 14 days before adding or replacing one (DPA, section 7), by email to the workspace's owners and on this page, or as soon as we can when one must be replaced at short notice to keep the service secure or running.
Processing callers' data
| Subprocessor | What they do for Vorelai | Data they process | Where |
|---|---|---|---|
| Google LLC (Gemini API, on a paid Google Cloud account) | Runs the AI that talks with callers; transcribes the caller a second time after the call; summarizes the call; turns knowledge documents into search vectors | The caller's audio during the call, what was said, the agent's instructions and knowledge, what the agent looks up | Google's global infrastructure; transfers under Google's Cloud Data Processing Addendum and the EU Standard Contractual Clauses |
| Supabase, Inc. | Database, file storage (call recordings), sign-in for dashboard users, server functions | Call records (the caller's number, transcript, summary), recordings, agents, knowledge, workspace settings, dashboard users' emails | Frankfurt, Germany (eu-central-1), on AWS |
| DigitalOcean, LLC | Hosts the servers that receive calls (Asterisk) and connect them to the AI (the media gateway) | Call audio passing through; the caller's number in a security log kept 3 days; a call record kept up to 7 days only if the database can't take it | Frankfurt, Germany |
| Resend, Inc. | Sends emails: call summaries to the addresses a business chose, team invitations, sign-up and password emails, low-credit alerts | For call emails: the caller's number and the call's summary. For the rest: the recipient's email address | Ireland (EU), Resend's EU sending region. Resend, Inc. is a US company: any access from the United States is under the EU Standard Contractual Clauses |
Processing no callers' data
| Service | What for | Why it isn't a subprocessor of callers' data |
|---|---|---|
| Grafana Labs (Grafana Cloud) | Monitoring the servers | Receives counts and timings only, with labels from fixed lists: never a caller, a number or a workspace |
| Lemon Squeezy (Lemon Squeezy LLC) | Payments, as merchant of record | Processes the paying business's billing details as an independent controller; never sees calls |
| Cloudflare, Inc. (Pages, Turnstile) | Hosting the website and the dashboard's files; bot protection on the dashboard's sign-up | Serves pages and sees visitors' browsers, not callers; the dashboard's data goes from the browser to Supabase |
| Let's Encrypt (ISRG) | TLS certificates | Certificates name our servers only |
Chosen by the customer
A business may connect services of its own: its calendar (Google Calendar or Cal.com) for bookings, its own tools (an API the agent calls), webhooks after calls, and its own Gemini API key. Data sent there goes on the business's instruction to providers it chose, under its own agreements with them. They are not Vorelai's subprocessors.