Sub-processors
Last updated: 2026-07-26
TelPal uses a small number of vetted service providers to deliver the product. Each processes personal data only on our instructions, under a data processing agreement, and — where located outside the EU/EEA — under the European Commission's Standard Contractual Clauses. Stored customer data (voicemails, transcripts, call records, documents) stays in the EU. See also our privacy policy.
We update this page when the list changes. Questions: privacy@telpal.ai.
| Provider | Purpose | Data involved | Region |
|---|---|---|---|
| Telnyx LLC | Licensed carrier infrastructure: number provisioning, call routing, voicemail recording, regulatory verification of number-eligibility documents. Voicemail audio is downloaded to our EU store and then deleted from the carrier, so it is not retained carrier-side. | Phone numbers, call metadata, voicemail audio (transient — deleted after download), number-eligibility (KYC) documents | EU: accessed via the EU API endpoint (api.telnyx.eu, Frankfurt) with the account Data Storage Location set to Germany (covers CDRs, media/recordings, transcripts); US entity under EU Standard Contractual Clauses |
| Supabase | Database and private file storage (accounts, call records, transcripts, voicemail audio, eligibility documents) | Account data, call records, transcripts, voicemail audio, eligibility documents | EU |
| Cloudflare, Inc. | Web hosting and content delivery for telpal.ai | IP addresses, request metadata | Global edge; EU SCCs / Data Privacy Framework |
| DigitalOcean LLC | Backend application hosting | Data in transit through the call-handling backend | EU data center; US entity under EU Standard Contractual Clauses |
| Stripe, Inc. | Payment processing and subscription billing (PCI DSS Level 1) | Billing name, email, payment details (card data never touches our systems) | US/global under EU Standard Contractual Clauses |
| Mailjet (Sinch) | Transactional email (voicemail and account notifications, magic-link sign-in). Notification emails contain call details and a dashboard link, and — only when the account explicitly turns it on — a truncated voicemail transcript. Voicemail audio is never emailed. | Recipient email, caller number and call time, and (opt-in only) a truncated voicemail transcript | EU (Frankfurt + Belgium) — EU data residency |
| ElevenLabs | Voice-greeting synthesis from text | Greeting script text only (no caller or call data) | US under EU Standard Contractual Clauses |
| Gladia SAS | Voicemail transcription (speech-to-text); contractually prohibited from training models on customer audio | Voicemail audio (processing only; storage stays in our EU store) | EU (France) — EU data residency |
| Crisp IM SAS | Support chat widget (loaded only with consent) | Name, email, chat messages you send to support | EU (France) |
| PostHog (EU Cloud) | Product analytics (loaded only with consent) | Usage events, pseudonymous identifiers | EU |
| Google LLC (Firebase Cloud Messaging) | Mobile app only: delivery of inbound-call push notifications to wake the Android app. The device push token is registered with our carrier (Telnyx), which dispatches the wake push via FCM. | Android device push (FCM registration) token | US/global under the EU-US Data Privacy Framework and EU Standard Contractual Clauses; processor |
| Apple Inc. (APNs / PushKit) | Mobile app only: delivery of inbound-call push notifications to wake the iOS app. The device VoIP push token is registered with our carrier (Telnyx), which dispatches the wake push via APNs. Apple acts as a separate/independent controller for APNs delivery (Apple offers no processor agreement for APNs). | iOS device VoIP push (APNs) token | US — separate/independent controller; EU Standard Contractual Clauses |