Vocalyy
Talk to us Talk to us

List of Sub-processors

Version 2.0 — last updated 9 July 2026

In accordance with Article 28 of the GDPR, we publish the complete list of sub-processors that Vocalyy SRL uses to provide you with the AI voice agent service. All sub-processors process data exclusively on the basis of our documented instructions and, where applicable, have signed data processing agreements (DPA) with us.

What is a sub-processor? It is a third party that Vocalyy uses to process personal data on our behalf, so that we can provide you with the AI voice agent service. For example, ElevenLabs processes the caller's voice to convert it to text (speech-to-text) and to generate the agent's spoken response (text-to-speech).
Important — storage of audio recordings: The audio recording of each call is stored and hosted by ElevenLabs, not on Vocalyy's servers. The Vocalyy dashboard displays a "Download audio" button. Pressing this button downloads the audio recording directly from ElevenLabs to the client's own device — Vocalyy's servers do not store and do not have persistent access to the audio file at any point. From the moment of download, the client becomes the sole controller of that copy of the audio recording and is solely responsible for its security, storage, and any further processing.

Active sub-processors

Provider Service Data categories Location Transfer mechanism
ElevenLabs [X — exact legal entity name to be confirmed] Voice AI (speech-to-text + text-to-speech); stores and hosts call audio recordings, downloadable on request by the client Voice/audio, transcription in transit [X — to be confirmed] [X — DPF or SCC, to be confirmed]
Telnyx LLC Telephony / call routing Phone number, audio in transit, call metadata USA (with option for EU data residency) [to be reconfirmed] DPF [to be reconfirmed]
Anthropic PBC LLM model (Claude) — generates the agent's conversational responses; processes the transcript in real time Transcript content (in transit/processing) [to be reconfirmed] DPF [to be reconfirmed — current status]
Supabase Inc. PostgreSQL database + authentication Account data, operational data EU (Frankfurt, Germany) In the EU — no transfer
Render Services, Inc. Backend hosting Operational/application data USA DPF [to be reconfirmed if still in use]
Resend Transactional email Email addresses, notification content USA SCC-DPF [to be reconfirmed if still in use]
Cal.com Inc. Demo call scheduling Contact data for scheduling EU / USA [to be reconfirmed if still in use] [to be reconfirmed if still in use]
Stripe Payments Europe Ltd. Payment processing Billing/payment data EU (Ireland) [to be reconfirmed if still in use] In the EU — no transfer
Google LLC Google Workspace Calendar (OAuth integration) Calendar/scheduling data USA [to be reconfirmed if still in use] DPF [to be reconfirmed if still in use]
SmartBill SRL Invoicing (Romania) Billing data Romania In the EU — no transfer [to be reconfirmed if still in use]

The list above reflects the current providers known at the time of drafting. Items marked [X] are to be confirmed by Vocalyy SRL before publication. OpenAI, L.L.C. is not and has not been used by Vocalyy for any personal data processing service.

Sub-processors under evaluation

These are providers we are evaluating for future integration. They do not process personal data at this time.

  • Microsoft Azure — for EU data residency for clients who request it (planned)
  • HubSpot — CRM integration (at client's request)
  • Twilio — telephony alternative (under evaluation as a backup)

How we manage international transfers

For each sub-processor located outside the European Economic Area (EEA), we use one of the following legal mechanisms:

  • EU-US Data Privacy Framework (DPF) — for certified US sub-processors
  • Standard Contractual Clauses (SCC) — approved by the European Commission, for the others
  • Transfer Impact Assessments (TIA) — for higher-risk cases

The exact mechanism applicable to each sub-processor is indicated in the table above; items marked [X] are to be confirmed.

Notification of changes

We will notify all our clients at least 30 days before adding a new sub-processor. Clients have the right to object and to terminate the contract without penalties if they do not agree with a significant change.

Notification is provided through:

  • Email to each client's primary contact
  • Update on this page
  • Notification in the dashboard

How you can object

If you are a Vocalyy B2B client and you object to the addition of a new sub-processor, write to us at dpo@vocalyy.ro within 30 days of the notification. We will find an alternative solution or, if that is not possible, you will be able to terminate the contract without penalties.

Contact

For questions about sub-processors or data processing:

This page is part of our transparency policy. See also: Privacy Policy · Terms and Conditions · Retention Policy · AI System Information · Data Processing Agreement (DPA)

This document was drafted with computer assistance based on information available at the time of drafting and does not constitute legal advice from a licensed attorney. Vocalyy SRL recommends that this document be reviewed by an attorney specializing in data protection before publication, signature, or use in client relationships.