Sub-processors
Last updated: May 8, 2026
1. Current Sub-processors
GreetEvo engages the following sub-processors to provide the Service. All sub-processors are contractually bound by data processing agreements that meet or exceed the requirements of Article 28 of the GDPR and equivalent frameworks.
| Sub-processor | Function | Location | Data Processed | Transfer Mechanism |
|---|---|---|---|---|
| Twilio Inc. | Telephony, voice routing, SMS delivery, and Programmable Voice infrastructure. | United States | Phone numbers, call audio streams, SMS content, call metadata. | EU SCCs (Module 2 for GreetEvo account data / Module 3 for Caller Personal Data) |
| Stripe Inc. | Payment processing, billing, subscription management, and invoicing. | United States | Payment card details (tokenised), billing addresses, transaction history, subscription status. Note: Stripe handles payment data directly; GreetEvo does not store full payment card numbers. | EU SCCs (Module 2) |
| Supabase Inc. | Managed PostgreSQL database, authentication, and real-time data services. | United States (primary) | Account data, call records, transcripts, caller information, appointment data, user profiles, authentication tokens. | EU SCCs (Module 3) |
| Railway.app (Railway Corporation) | Server hosting, container orchestration, and compute infrastructure. | United States | Application data in transit and at rest during processing, including account data, call recordings, call transcripts, caller information, and appointment data. | EU SCCs (Module 3) |
| Vercel Inc. | Web hosting, edge network delivery, and serverless function execution for the GreetEvo platform and customer websites. | United States (global edge network) | Web request data, customer portal content, static assets, analytics metadata. | EU SCCs (Module 3) |
| Google Cloud Platform (Google LLC) | Cloud infrastructure for database hosting, server hosting, and compute resources. | United States | Application data in transit and at rest during processing, including account data, call recordings, call transcripts, and caller information. | EU SCCs (Module 3) |
| Deepgram Inc. | Speech-to-text transcription and audio intelligence for call recordings. | United States | Call audio recordings and associated metadata for transcription purposes. | EU SCCs (Module 3) |
| Groq Inc. | Large language model (LLM) inference for post-call transcript analysis, conversational summarisation, and non-real-time AI processing. | United States | Call transcripts, conversation text, system prompts, and contextual metadata required for AI processing. Call audio is not sent to Groq. | EU SCCs (Module 3) |
| OpenAI LLC | Real-time conversational AI and language model inference for live AI receptionist voice interactions via the OpenAI Realtime API. | United States | Call audio streams, conversation text, system prompts, and contextual metadata required for real-time AI voice processing. Transcripts are not sent to OpenAI; OpenAI receives live audio streams only. | EU SCCs (Module 3) |
| SendGrid (Twilio Inc.) | Primary transactional and marketing email delivery provider. | United States | Email addresses, email content, delivery metadata, open/click tracking data. | EU SCCs (Module 3) |
| Mailgun (Pathwire / Sinch AB) | Secondary transactional email delivery provider, used for redundancy and specific routing requirements. | United States | Email addresses, email content, delivery metadata. | EU SCCs (Module 3) |
| Google STUN Servers (Google LLC) | NAT traversal discovery for peer-to-peer video meeting connections. STUN servers receive IP addresses to help peers discover direct routes; no media content is relayed. | Global | IP addresses and session signalling data for NAT discovery only. | IP addresses processed transiently for connection establishment only; no personal data retained or logged. |
| OpenRelay / Metered.ca | TURN relay server for NAT traversal and media relay during video meetings when direct peer-to-peer connections cannot be established. | Global (relay network) | Real-time encrypted video and audio streams, session signalling data, and IP addresses for NAT traversal. | EU SCCs (Module 3) |
2. Objection Process for New Sub-processors
We may update this list from time to time as our business needs evolve. Before engaging any new sub-processor that will process caller personal data, we will:
- Carry out appropriate due diligence to ensure the sub-processor can meet our data protection and security requirements.
- Enter into a written agreement with the sub-processor that includes obligations materially equivalent to those in our DPA.
- Notify all affected business customers of the intended addition at least 30 days before the new sub-processor begins processing caller personal data.
As a business customer, you have the right to object to a new sub-processor on reasonable data protection grounds. To object, please email us at privacy@greetevo.com within the 30-day notice period, specifying:
- •Your business name and account identifier.
- •The name of the sub-processor you are objecting to.
- •A clear statement of the reasonable data protection grounds for your objection.
If you object to a new sub-processor, we will work with you in good faith to find a commercially reasonable alternative solution. If we cannot agree on an alternative within 15 days of your objection, you may terminate the affected portion of the Service without penalty. Termination under this policy does not relieve you of any fees accrued prior to termination.
We will not transfer caller personal data to a new sub-processor during the objection window unless you explicitly withdraw your objection or the objection window expires without an objection being raised.
3. Transfer Safeguards
Where a sub-processor processes caller personal data outside the European Economic Area (EEA), the United Kingdom, or Canada, GreetEvo ensures that appropriate safeguards are in place for the transfer. These safeguards include:
- •EU Standard Contractual Clauses (SCCs) approved under Commission Implementing Decision (EU) 2021/914, where applicable.
- •The UK International Data Transfer Addendum to the EU SCCs for transfers from the United Kingdom.
- •Adequacy decisions by the European Commission where the destination country has been recognised as providing an adequate level of data protection.
- •Additional technical safeguards, such as encryption in transit and at rest, to supplement contractual transfer mechanisms.
A summary of our Transfer Impact Assessments (TIAs) is available upon written request.
4. Updates to This List
We review and update this sub-processor list regularly. The "Last updated" date at the top of this page indicates when the list was last modified. Material changes, including the addition of a new sub-processor that processes caller personal data, will be communicated to business customers in accordance with the objection process described in Section 2.
For historical reference, previous versions of this list are available upon request.
5. Contact
If you have questions about our sub-processors, would like to object to a new sub-processor, or need further information about transfer safeguards, please contact us at privacy@greetevo.com or through the Contact page.