Back to home
Legal Document
Sub-processor Register
The third parties handlo.ai engages to process personal data, kept current under GDPR Articles 28 and 30.
Last updated: November 2, 2026|Effective: November 2, 2026
The following table lists the sub-processors handlo.ai engages to process personal data on behalf of its customers, including the purpose, the categories of data, the hosting location, and the lawful transfer mechanism.
| Sub-processor | Purpose | Data categories | Hosting location | Transfer mechanism |
|---|---|---|---|---|
| Supabase, Inc. | Primary database and file storage | Contact identifiers, Call data, AI-generated data, Account data | European Union and/or United States (currently United States: Oregon, AWS us-west-2) | Standard Contractual Clauses (Module 3) for hosting in the United States |
| Vercel Inc. | Web application and API hosting, serverless compute (including the knowledge lookups and tool requests the AI agent makes during calls), private storage of per-agent knowledge index snapshots (Vercel Blob), content delivery, and bot detection (BotID) | Account data, Contact identifiers, Call data, Transcript, Knowledge-base content, IP address, Device / browser signals | European Union and/or United States (currently United States: the web application, API compute, in-call knowledge lookups and tool requests, and knowledge index snapshot storage in Portland, Oregon); global edge network | Standard Contractual Clauses (Module 3) |
| Vapi.ai | AI voice call processing and the managed speech pipeline | Caller phone number, Call recording, Transcript | United States | Standard Contractual Clauses (Module 3) |
| Google LLC | Gemini language model that generates the AI agent’s replies during calls and speech-recognition fallback (engaged via Vapi); Calendar integration and Google Drive document ingestion (when enabled) | Transcript, Call audio, Assistant configuration, Knowledge-base content, Calendar event data, Document content, Account data | United States | Standard Contractual Clauses (Module 3) |
| Anthropic, PBC | Claude language model that generates the AI agent’s replies during calls (engaged via Vapi) | Transcript, Assistant configuration, Knowledge-base content | United States | Standard Contractual Clauses (Module 3); engaged via Vapi |
| OpenAI, L.L.C. | Embeddings, summarization, website reading for knowledge and demos, abuse screening, and AI content generation | Transcript, Knowledge-base content, AI-generated data | United States | Standard Contractual Clauses (Module 3) |
| Soniox, Inc. | Speech-to-text transcription of calls (engaged via Vapi) | Call audio, Transcript, Business names and terms from the knowledge base | United States | Standard Contractual Clauses (Module 3); engaged via Vapi |
| ElevenLabs, Inc. | Text-to-speech voice synthesis (engaged via Vapi) | Assistant speech content | United States | Standard Contractual Clauses (Module 3); engaged via Vapi |
| Cartesia AI | Text-to-speech voice synthesis (engaged via Vapi) | Assistant speech content | United States | Standard Contractual Clauses (Module 3); engaged via Vapi |
| Microsoft Azure | Text-to-speech / speech-to-text for select languages (engaged via Vapi); embeddings of callers' knowledge questions (Azure OpenAI, engaged directly) | Assistant speech content, Call audio, Transcript | United States (embeddings: US West; speech: region managed by Vapi) | Standard Contractual Clauses (Module 3) |
| CNTXT – FZCO (Munsit) | Arabic-dialect text-to-speech voice synthesis (Arabic voices only) | Assistant speech content | United Arab Emirates | Standard Contractual Clauses (Module 3) |
| Twilio Inc. | Phone infrastructure, WhatsApp message transport (BSP), and phone-number reputation (Lookup) | Caller phone number, Notification content | United States | Standard Contractual Clauses (Module 3) |
| Telnyx LLC | Phone infrastructure | Caller phone number | United States | Standard Contractual Clauses (Module 3) |
| Meta Platforms, Inc. | WhatsApp platform / notification delivery | Caller phone number, Notification content | United States | Standard Contractual Clauses (Module 3) |
| Telegram Messenger Inc. | Telegram notification delivery to the Customer's own Telegram chat (only when the Customer enables it) | Notification content | Outside the EEA | At the Customer's instruction — the Customer selects Telegram as its own notification channel |
| Stripe, Inc. | Payment processing (Stripe acts as an independent controller for payment data) | Billing contact, Payment metadata | United States | Standard Contractual Clauses (Module 3); Stripe's own controller-level safeguards apply |
| Resend, Inc. | Transactional email delivery | Recipient email, Notification content | United States | Standard Contractual Clauses (Module 3) |
| Functional Software, Inc. (Sentry) | Error monitoring and diagnostics (processes only Handlo diagnostic data) | IP address, Diagnostic metadata | United States | Standard Contractual Clauses (Module 3) |
| Cloudflare, Inc. | Bot verification on public forms and calls (Turnstile), DNS, private storage of call recordings (R2), and private temporary intake of call recordings (R2) from the voice provider | IP address, Device / browser signals, Call recording | Global network (Turnstile, DNS); call-recording storage in the European Union and/or United States (currently United States: Western North America location hint; recordings stored before this storage was introduced remain with Supabase in the European Union until moved); temporary recording intake in the European Union and/or United States (currently a Western Europe location hint). Location hints are best-effort placement, not a jurisdiction guarantee | Standard Contractual Clauses (Module 3) for hosting in the United States |
| Upstash, Inc. | Rate limiting and short-lived caching | Caller phone number, Cached assistant configuration, Transient call-session data, Aggregated analytics | European Union and/or United States (currently United States: Oregon, us-west-2) | Standard Contractual Clauses (Module 3) for hosting in the United States |
| Amazon Web Services, Inc. | Background worker / job-processing compute and job queue (exports, recordings, transcripts) | Contact identifiers, Call data, AI-generated data, Account data | European Union and/or United States (currently European Union: Frankfurt, eu-central-1) | Standard Contractual Clauses (Module 3) for hosting in the United States; currently EU-hosted, with no transfer outside the EEA |
| PostHog, Inc. | Product analytics (consent-gated; ingest reverse-proxied via /ingest) | Usage / event data, IP address, Pseudonymous user identifier | European Union and/or United States (currently European Union: PostHog EU Cloud) | Standard Contractual Clauses (Module 3) for hosting in the United States; currently EU-hosted, with no transfer outside the EEA |
| Crisp IM SAS | Support live-chat widget | Contact identifiers, Support message content, IP address | European Union (France) | EU hosting — no transfer outside the EEA |
| IPQualityScore, Inc. (IPQS) | Caller phone-number reputation / spam scoring (Growth and Business tiers) | Caller phone number | United States | Standard Contractual Clauses (Module 3) |
| Microsoft Corporation | OneDrive & SharePoint document ingestion and Outlook calendar booking (when enabled) | Document content, Account data, Appointment data | United States / European Union | Standard Contractual Clauses (Module 3) |
| HighLevel, Inc. (GoHighLevel) | CRM sync to the Customer's connected GoHighLevel account (when enabled) | Contact identifiers, Lead / opportunity data, Call summary | United States | At the Customer's instruction — sent only to the Customer's own connected account, under the Customer's agreement with that provider |
| HubSpot, Inc. | CRM sync to the Customer's connected HubSpot account (when enabled) | Contact identifiers, Lead / deal data, Call summary | United States | At the Customer's instruction — sent only to the Customer's own connected account, under the Customer's agreement with that provider |
| Block, Inc. (Square) | Appointment booking and customer lookup in the Customer's connected Square account (when enabled) | Contact identifiers, Appointment data | United States | At the Customer's instruction — sent only to the Customer's own connected account, under the Customer's agreement with that provider |
| Octopusapp Inc. (Jobber) | Customer lookup and request intake in the Customer's connected Jobber account (when enabled) | Contact identifiers, Request / job data | Canada / United States | At the Customer's instruction — sent only to the Customer's own connected account, under the Customer's agreement with that provider |
| Themis Solutions Inc. (Clio) | Enquiry intake to the Customer's connected Clio Grow account (when enabled) | Contact identifiers, Enquiry details | Canada / United States / European Union (per the Customer's Clio region) | At the Customer's instruction — sent only to the Customer's own connected account, under the Customer's agreement with that provider |
| Zoho Corporation | CRM and booking sync to the Customer's connected Zoho CRM or Zoho Bookings account (when enabled) | Contact identifiers, Lead / appointment data | Per the Customer's Zoho data centre (e.g. United States, European Union, India) | At the Customer's instruction — sent only to the Customer's own connected account, under the Customer's agreement with that provider |
We will notify customers at least 30 days before adding or replacing a sub-processor, as set out in our Data Processing Addendum.