Sub-processors
Last updated: 2026-08-25
When you use Otengo, we process personal data on your behalf. To do that we use a small number of other companies - our sub-processors. This page names all of them. It forms part of the Data Processing Agreement, and the notice period below is contractual.
1. Who we use
| Company | What they do | What they see | Where | Basis |
|---|---|---|---|---|
| Supabase Supabase, Inc. | Database, authentication and file storage Data is stored in the EU. The company is US-incorporated, so the Clauses cover the possibility of remote administrative access from the US. | Everything we hold: call records, transcripts, recordings, contacts, consent records, merchant accounts | European Union (Frankfurt) | Standard Contractual Clauses (with the UK Addendum for UK data) |
| ElevenLabs ElevenLabs, Inc. | Speech recognition and speech synthesis - the voice of the assistant Contracted with retention switched off and a written term that our merchants' and their customers' data is never used to train models. | Call audio and the transcript of the conversation | United States, or the European Union on our enterprise agreement | Standard Contractual Clauses, plus EU-US Data Privacy Framework certification |
| Twilio Twilio Inc. Announced, not yet processing | Phone numbers, call connection and SMS delivery Telephony provider selection is being finalised. No merchant data has been processed by them yet. | Phone numbers, call times and durations, SMS content, and call audio while the call is in progress | United States; SMS can be processed in the European Union (Ireland) | Standard Contractual Clauses, plus EU-US Data Privacy Framework certification |
| Anthropic Anthropic, PBC | Reading a merchant's own website and product catalogue to build the assistant's knowledge base Contractually not used for model training. | The merchant's public website content and catalogue. Not call audio, not transcripts, not customer records | United States | Standard Contractual Clauses (with the UK Addendum for UK data) |
| Vercel Vercel, Inc. | Hosting for our website and application Runtime logs are retained for one day and are not forwarded anywhere. | Request metadata, including IP addresses, in short-lived runtime logs | United States and global edge network | Standard Contractual Clauses (with the UK Addendum for UK data) |
| Resend Plus Five Five, Inc. | Sending service email - call summaries, alerts, account notices | Merchant email addresses and the content of the emails we send them | United States | Standard Contractual Clauses (with the UK Addendum for UK data) |
Every one of them is under a written contract that limits them to processing data on our instructions, requires them to keep it confidential and secure, and obliges them to delete it when we tell them to. Where a company is capable of using data to train AI models, that is contractually excluded for your data and your customers’ data.
2. Data leaving the EEA
- 2.1Your records - call history, transcripts, recordings, contacts, consent records - are stored in the European Union.
- 2.2Making a phone call is not a storage operation, and the audio of a live call travels through the telephone network and the speech provider in real time. So some processing happens outside the EEA even though storage does not. We would rather say that plainly than claim everything stays in Europe.
- 2.3For those transfers we rely on the Standard Contractual Clauses as the primary safeguard, with the UK Addendum for data about people in the UK, and we keep a written assessment of the risk for each provider.
- 2.4Several of our providers are also certified under the EU-US Data Privacy Framework. We treat that as a secondary basis rather than the main one, deliberately: the Framework is under appeal to the Court of Justice, and arrangements of that kind have been struck down twice before. The Clauses do not depend on it.
3. How changes are notified
- 3.1We give 30 days’ notice before a new sub-processor starts processing your data. During that period you can object.
- 3.2A company shown as announced in the table above is inside that notice period. It has no access to anything yet.
- 3.3If you object on reasonable data-protection grounds and we cannot offer an alternative, you may end your agreement for the affected service without penalty. We would rather hear the objection than lose you quietly.
- 3.4To be told when this page changes, email info@otengo.com and we will add you to the notification list.
4. Who is not on this list
Shopify is not listed as a sub-processor. Shopify is your own platform provider under your agreement with them; we receive data from it rather than engaging it on your behalf.
Nor do we list the payment provider: billing runs through Shopify, on your existing Shopify invoice, so we never see your card details. Any service you connect yourself from inside the app is your own choice of provider rather than our sub-processor, and it is named at the point you connect it.