List of Sub-processors
In accordance with Article 28 of the GDPR, we publish the complete list of sub-processors that D.O.D.O. OFFICE OUTLET S.R.L. uses to provide you with the AI voice agent service. All sub-processors process data exclusively on the basis of our documented instructions and, where applicable, have signed data processing agreements (DPA) with us.
Active sub-processors
| Provider | Service | Data categories | Location | Transfer mechanism |
|---|---|---|---|---|
| SpaceX Super Intelligence LLC (xAI) | The voice agent's AI. Grok Voice (grok-voice-3.0) hears the caller, decides the answers and actions during the call and speaks the agent's replies | Caller's voice (audio), phone number, conversation content, details captured on the call | USA (and other countries where xAI and its sub-processors process data) | Standard Contractual Clauses (Commission Decision 2021/914, Module Two or Three), incorporated in the xAI DPA, §8.2 |
| OpenAI Ireland Ltd (with OpenAI, L.L.C. and its affiliates) | Models used alongside the voice agent. gpt-4o-mini-transcribe listens again, during the call, to a short sentence the agent may have misheard; gpt-5.6-luna extracts, after the call, the details the business asked for; text-embedding-3-small searches the agent's knowledge base | Caller's voice (audio), phone number, conversation content, details captured on the call | USA | OpenAI Ireland Ltd is the processor, in the EU; its onward transfer to its US affiliates relies on Standard Contractual Clauses (OpenAI DPA, §4.1) |
| ElevenLabs [exact registered name and address, to be confirmed] | Transcribes the call recording after the call (Scribe, speech-to-text), producing the written transcript the business reads. Not used during the call and not the agent's voice. Only for agents with recording switched on. ElevenLabs' own retention is governed by the ElevenLabs DPA (section 9.2) | The call's audio recording (both voices) | USA (State of New York) | SCC (incorporated in the ElevenLabs DPA) |
| Telnyx LLC | Telephony: phone numbers, call routing, carrying the call's audio to the voice engine, transfers to a person, optional noise suppression, and SMS notifications | Phone number, call audio in transit, call metadata, content of SMS notifications (may include details captured on the call) | USA [EU data residency option to be reconfirmed] | DPF [to be reconfirmed] |
| Supabase Inc. | Database, authentication and file storage, including call recordings and transcripts | All data held by the platform: account data, call data, recordings, transcripts | EU (Frankfurt, Germany) | N/A (within the EU) |
| Render Services, Inc. | Hosting of the voice engine | Call audio and the call's data passing through the voice engine | EU (Frankfurt, Germany) | Servers in the EU; US company: DPF [to be reconfirmed] |
| Vercel Inc. | Hosting of the platform and the website | All data processed by the platform: account data, call data, recordings and transcripts in transit | EU (Frankfurt, Germany); requests cross its global network on the way | Servers in the EU; US company: DPF [to be reconfirmed] |
| Resend | Email: account emails and after-call notifications to the business | Email addresses; notification content, which may include the caller's number and details captured on the call | USA | SCC-DPF [to be reconfirmed] |
| Google LLC / Google Ireland Limited (Gemini API) | AI language models used beside the voice agent's own: drafting, summaries and checks on call content | Transcripts and details captured on the call; the agent's configuration | USA / EU | SCCs + TIA [to be confirmed] |
| Google Cloud / Firebase (Google LLC / Google Ireland Limited) | Cloud infrastructure: compute, storage, database and authentication services | Caller Data in transit and at rest; account data | EU / USA | SCCs + TIA where USA [to be confirmed] |
| Stripe Payments Europe Ltd. | Payments | Billing/payment data | EU (Ireland) | N/A (within the EU) |
| 2invoice [registered name to be confirmed] | Issuing invoices | The client's billing details | Romania | N/A (within the EU) |
| Formagrid, Inc. (Airtable) | Receives the sign-up form of new clients | The client's contact details from the sign-up form (company, name, email, phone, tax ID, address) | USA | [To be confirmed] |
| Anthropic PBC | AI-assisted drafting of support-ticket replies, and the replies of the business's Telegram chatbot if the business connects one. Not part of the phone call flow | Support message content; Telegram chat messages | USA | DPF |
| Telegram | Optional. After-call notifications to the business's Telegram group (sent by Vocalyy's bot), and the business's own Telegram chatbot | Caller's number, details captured on the call and, if the business asks for it, the transcript; chat messages | [To be confirmed] | [To be confirmed] |
| Google LLC / Google Ireland Limited | Optional. Calendar (bookings) and Sheets (a row per call), when the business connects its Google account; Maps geocoding, on Vocalyy's account, for agents that check a delivery zone | Caller's name, number and request; details captured on the call; the delivery address (geocoding) | USA / global | DPF [to be reconfirmed] |
| Microsoft Ireland Operations Ltd | Optional. Bookings in the business's Microsoft 365 (Outlook) calendar, when the business connects its account | Caller's name and number | EU / USA | DPF [to be reconfirmed] |
| Calendly LLC | Optional. Reads the business's free slots, when the business connects its account | No caller data is sent; details of people who book through Calendly are received | USA | DPF [to be reconfirmed] |
| ChoiceQR, boogiT, SoftOK, GestSel | Optional, per agent. Sends phone orders into the restaurant's ordering or till system | Caller's name, phone number, delivery address and order | Romania / EU [to be confirmed per provider] | N/A (within the EU) [to be confirmed] |
| HubSpot, Pipedrive, Zoho, Streak | Optional. Logs each call in the business's CRM, when the business connects it | Caller's name and number, call summary and transcript, a link to the call in Vocalyy (no audio file) | USA / EU, per provider | Per the provider's DPA [to be confirmed] |
xAI official documents (SpaceX Super Intelligence LLC): their Data Processing Addendum · their sub-processor list. The international transfer to xAI relies on the Standard Contractual Clauses (Module Two or Three) incorporated in their DPA.
ElevenLabs official documents: their Data Processing Agreement · their compliance portal, where their own sub-processor list is published. The international transfer to ElevenLabs relies on the Standard Contractual Clauses incorporated in their DPA.
Entries marked “to be confirmed” are contractual details (registered names, transfer mechanisms) still being confirmed with each provider; the services and the data each provider receives are as stated.
Sub-processors under evaluation
None at this time. A provider we start using is added to the table above first, with the 30-day notice described below.
How we manage international transfers
For each sub-processor located outside the European Economic Area (EEA), we use one of the following legal mechanisms:
- EU-US Data Privacy Framework (DPF)
- for certified US sub-processors
- Standard Contractual Clauses (SCC)
- approved by the European Commission, for the others
- Transfer Impact Assessments (TIA)
- for higher-risk cases
The exact mechanism applicable to each sub-processor is indicated in the table above.
Notification of changes
We will notify all our clients at least 30 days before adding a new sub-processor. Clients have the right to object and to terminate the contract without penalties if they do not agree with a significant change.
Notification is provided through:
- Email to each client's primary contact
- Update on this page
- Notification in the dashboard
How you can object
If you are a Vocalyy B2B client and you object to the addition of a new sub-processor, write to us at agent@vocalyy.ro within 30 days of the notification. We will find an alternative solution or, if that is not possible, you will be able to terminate the contract without penalties.
Contact
For questions about sub-processors or data processing:
- Privacy contact channel: agent@vocalyy.ro
- General contact: agent@vocalyy.ro
This page is part of our transparency policy. See also: Privacy Policy · Terms and Conditions · Retention Policy · AI System Information · Data Processing Agreement (DPA)