This page lists the third-party service providers (“sub-processors”) that may process personal data on behalf of IzzyOS LLC in providing the IzzyOS Service. It is published under Article 28(4) of the GDPR and the equivalent provisions of UK-GDPR, PIPEDA, and CCPA.
What is a sub-processor?
A sub-processor is a vendor or service provider that processes personal data on our behalf. We use sub-processors to deliver core platform functionality (database, hosting, email, SMS, voice, payments, AI inference). Each sub-processor is bound by contractual obligations of confidentiality, security, and data protection that are at least as strict as those we agree to with you.
Change notification
We will give at least 30 days’ advance notice of any new sub-processor or material change to the list, by updating this page and emailing the registered account contact for affected customers. You may object to a new sub-processor by emailing privacy@izzyos.com within the notice period. If we cannot accommodate your objection, you may terminate your subscription with a pro-rata refund of any pre-paid period.
Current sub-processors
Infrastructure
| Provider | Purpose | Data categories | Country |
|---|
| Supabase, Inc. | Primary database, authentication, file storage, edge function compute | All customer data and contact data — account info, communication content, AI memory, usage events, files | United States (AWS region) |
| Vercel, Inc. | Web application hosting, edge runtime, custom domain routing | IP addresses, request metadata, edge function execution logs | United States (with global edge) |
| Cloudflare, Inc. | DNS routing, DDoS protection (delivered through Vercel) | DNS queries, IP addresses | United States (with global anycast) |
AI
| Provider | Purpose | Data categories | Country |
|---|
| Anthropic, PBC | AI inference for Kai (reasoning, content generation, voice scripts) | Prompts, conversation context, contact context, generated outputs | United States |
| OpenAI, L.L.C. | AI inference for select features (image generation, fallback reasoning, structured extraction) | Prompts, generated outputs | United States |
| HeyGen Inc. | AI video avatar generation | Generated video outputs (no direct customer or contact PII) | United States |
Communications
| Provider | Purpose | Data categories | Country |
|---|
| Twilio Inc. | SMS messaging delivery, A2P 10DLC registration, phone number provisioning | Contact phone numbers, message content, delivery receipts | United States |
| Resend Inc. | Transactional and marketing email send, inbound email parsing | Contact email addresses, message content, delivery receipts, reply content | United States (EU region available, not currently configured) |
| Retell AI, Inc. | AI voice agents for outbound and inbound calls | Contact phone numbers, call audio, call transcripts, call metadata | United States |
Payments
| Provider | Purpose | Data categories | Country |
|---|
| Stripe, Inc. | Payment processing, subscription billing, Stripe Connect for partners, Payment Links | Customer name, email, payment method (we do not store full card numbers), billing address, transaction history | United States |
Productivity
| Provider | Purpose | Data categories | Country |
|---|
| Google LLC (Calendar API) | Calendar synchronization via OAuth (only when a user connects their Google Calendar) | Calendar events, attendee emails, availability windows | United States |
Social
| Provider | Purpose | Data categories | Country |
|---|
| Late (operated by Zernio) | Social media post scheduling and publishing across connected platforms | Posted content, schedule metadata, connected social account metadata | Subject to Zernio platform terms |
Content research
| Provider | Purpose | Data categories | Country |
|---|
| Relay.app | LinkedIn post research for content generation | LinkedIn URLs, scraped public post content | United States |
| Jina AI Limited | Web page reading and embedding for campaign brief research | Submitted URLs, scraped page content | Singapore / US |
| Apify Technologies s.r.o. | Structured web scraping for research workflows | Submitted URLs, scraped content | Czech Republic / EU |
| Pexels GmbH | Stock video and image API for video pipeline backgrounds | Search queries, asset IDs (no customer or contact PII) | Germany / EU |
Monitoring
| Provider | Purpose | Data categories | Country |
|---|
| Functional Software, Inc. (Sentry) | Error tracking and performance monitoring | Stack traces, breadcrumbs, anonymized user IDs, request metadata | United States |
| PostHog Inc. | Product analytics for feature usage and improvement | Behavioral events, session IDs, page views | United States (EU region available) |
Communications (in flight migration)
| Provider | Purpose | Data categories | Country |
|---|
| Telnyx LLC (in flight) | VoIP / SIP trunking for voice agents (replacing direct Twilio voice trunking) | Phone signaling metadata, call audio in transit | United States |
| LiveKit, Inc. (in flight) | Real-time audio/video infrastructure for voice agents (replacing Retell pipeline) | Audio streams, participant metadata | United States |
International data transfers
Most sub-processors are located in the United States. Where personal data of EU, UK, Swiss, or Canadian residents is transferred to a country outside the data subject’s jurisdiction, we rely on the Standard Contractual Clauses (SCCs) issued by the European Commission, the UK International Data Transfer Agreement (IDTA) for UK transfers, and Transfer Impact Assessments per the Schrems II decision. Each sub-processor signs SCCs as part of its standard Data Processing Agreement.
Sub-processor DPA inventory
IzzyOS LLC is in the process of completing and filing Data Processing Agreements with each sub-processor on this list. Where a sub-processor offers SCCs as part of its standard terms, those terms apply. You can request the DPA inventory status by emailing privacy@izzyos.com.
How this list is maintained
This page is updated whenever a sub-processor is added, removed, or replaced. The version number and effective date at the top reflect the latest version. The change history is preserved in our public source repository.
Questions
Email privacy@izzyos.com with sub-processor questions, objections, or DPA requests.