Skip to main content
HeyfixitHeyfixit

← All legal documents

Heyfixit Subprocessor List

Version 1.0 · Effective 11 November 2026 · heyfixit.ai/legal/subprocessors

This is the list that Annex 3 of our Data Processing Agreement (DPA) points to. It names the third parties that process Customer Personal Data for us when we provide the Services. Words defined in the Terms of Service and the DPA have the same meaning here.

1. How this list works

1.1 The whole bench. The list names every provider we use now and every provider we have ready to switch to. We move between listed providers often, for example to use a better or cheaper AI model. Moving between listed providers needs no notice (DPA 7.1).

1.2 No training. No provider on this list may use Customer Data to train AI models, except to detect fraud and abuse of its own service where its terms allow it. Each one is bound by written terms that say so before it handles Customer Data.

1.3 Retention. Each row shows how long that provider keeps the data it handles, where the provider states it. Where it does not, the row says that the provider's own retention policy applies. Where a provider offers zero data retention on the plan we use, we use it. We do not promise zero retention where it is not offered on that plan. The row says what the provider keeps instead.

1.4 Where data is stored. Our platform stores your Customer Data in your hosting region, as DPA Annex 1 describes. Providers on this list may process it, and keep copies for the periods shown, in other countries, including the EU and the United States.

1.5 Terms with each provider. Each listed provider is bound by written data protection terms before it handles Customer Personal Data (DPA Annex A.4(e)).

1.6 New providers. Before a provider that is not on the list starts to process Customer Personal Data, we add it here and give notice as the DPA describes (clause 7.2 and Annex A.4). Where the DPA gives you a right to object, you can do so as it describes.

1.7 Usage rules. Some providers set rules on how their services may be used. Our Acceptable Use Policy (clause 4) applies them to you. They are:

The other providers on the list set no rules that reach your use of the Services.

2. The list

"Personal data it handles" means anything about Contacts, the people the Agents contact, or about your Users: names, numbers, addresses, calls, recordings, transcripts, messages and photos.

"On the bench" means we have it ready to use and may switch to it without notice.

Provider Legal entity What it does for us Personal data it handles Where it stores and processes How long it keeps data Status
Hosting
Amazon Web Services Amazon Web Services, Inc. Cloud hosting: databases, file storage, containers, backups, logs, secrets All Customer Data our platform stores EU region, across its data centres there. Other regions only if an Order Form names one As long as we keep the data under our terms. Backups up to 35 days On the bench
Microsoft Azure Microsoft Corporation Cloud hosting: databases, file storage, containers, backups, logs, secrets All Customer Data our platform stores EU region. Other regions only if an Order Form names one As long as we keep the data under our terms. Backups up to 35 days On the bench
Google Cloud Google LLC Cloud hosting: databases, file storage, containers, backups, logs, secrets All Customer Data our platform stores EU region. Other regions only if an Order Form names one As long as we keep the data under our terms. Backups up to 35 days On the bench
Temporal Cloud Temporal Technologies, Inc. Runs the workflows that keep each conversation and job moving Workflow state for conversations and jobs. Message content and personal details are encrypted with our keys before they reach Temporal, so it cannot read them. AWS EU region (Frankfurt or Ireland), replication to other regions off Open workflows while they run; completed workflow history for 7 days In use
Calls and messages
LiveKit LiveKit Incorporated Relays call audio Call audio while a call is live. Call metadata, including phone numbers Call audio: relayed through its network while a call is live, and not stored. Project data: EU (Frankfurt) Call metadata, including phone numbers, up to 60 days; call-detail and billing records longer. While call monitoring is switched on, short audio and transcript extracts up to 30 days, plus encrypted backups for up to 30 more days In use
Twilio Twilio Inc. Phone numbers, calls, SMS and phone lines (SIP). Carries WhatsApp messages Phone numbers, call audio in transit, SMS and WhatsApp messages, photos sent by message Ireland (Dublin) for calls, SMS and phone lines. WhatsApp messages in the United States Messages and photos: deleted from Twilio once our platform has stored them. Call and message logs (numbers, times, status) under Twilio's own retention policy. Twilio may use message content to detect fraud and abuse. Twilio does not record our calls In use
AI models
OpenAI OpenAI OpCo, LLC AI models that read conversations and records and write the Agents' replies and actions. The AI tools our staff use, with read-only access, to investigate faults and analyse your data Conversation text, the case details the Agents need, Users' questions to Vera, and the records our staff need when investigating a fault or analysing your data United States, unless OpenAI approves EU data residency for our account We do not ask OpenAI to store responses. Zero data retention where approved on our account; otherwise OpenAI keeps inputs and outputs up to 30 days for abuse monitoring In use
Anthropic Anthropic, PBC AI models that read conversations and records and write the Agents' replies and actions. The AI tools our staff use, with read-only access, to investigate faults and analyse your data Conversation text, the case details the Agents need, Users' questions to Vera, and the records our staff need when investigating a fault or analysing your data Stored in the United States. Requests may be processed in the US, Europe, Asia and Australia We do not ask Anthropic to store responses. Zero data retention where approved on our account. Otherwise, and for some newer models even with zero retention, Anthropic deletes inputs and outputs within 30 days. Content its safety systems flag is kept up to 2 years In use
AWS Bedrock Amazon Web Services, Inc. AI models from several makers, hosted by AWS Conversation text, the case details the Agents need, Users' questions to Vera An AWS region in the EU, where the model is offered there. With cross-region inference, other regions AWS routes to Nothing kept when we turn data retention off. Otherwise, for some models, traffic is kept up to 30 days for abuse detection On the bench
Google Vertex AI (models) Google LLC AI models hosted by Google Conversation text, the case details the Agents need, Users' questions to Vera EU (multi-region) Cached up to 24 hours unless we turn caching off. Abuse-monitoring logs up to 90 days unless our agreement with Google exempts us On the bench
Microsoft Azure (models) Microsoft Corporation AI models hosted by Microsoft Conversation text, the case details the Agents need, Users' questions to Vera An EU region, or EU member states under an EU Data Zone deployment Abuse-monitoring copies, which Microsoft staff in the EEA may review, unless Microsoft approves turning them off, kept under Microsoft's own retention policy On the bench
Cloudflare Workers AI Cloudflare, Inc. AI models run on Cloudflare's network Conversation text, the case details the Agents need Cloudflare's global network Not kept after the response, for standard requests On the bench
Modal Modal Labs, Inc. Runs AI models we train ourselves Conversation text, the case details the Agents need United States by default. We can choose the regions it runs in Inputs and outputs up to 7 days. Logs 1 to 30 days, depending on plan On the bench
Google Vertex AI (embeddings) Google LLC Turns text into search vectors, so the Services can find related records Text from records and conversations sent to make search vectors. The vectors are kept in our own search index, not by Google EU (multi-region) Cached up to 24 hours unless we turn caching off In use
Speech
ElevenLabs Eleven Labs Inc. Turns the Agents' words into speech on calls. May turn speech into text The text the Agents speak on calls, and the speech it produces. Caller audio if used for speech to text United States. EU residency is an Enterprise feature Until we delete it. ElevenLabs may delete it after 180 days of inactivity. Opted out of its use of our content for training. Zero retention needs an arrangement with ElevenLabs; we use it if we get one In use
Deepgram Deepgram, Inc. Turns callers' speech into text. May turn the Agents' words into speech Caller audio on calls, the text it produces and the text the Agents speak United States, or the EU if we use its EU service Nothing kept after each request, because we opt out of its model-improvement programme on every request. Usage records 90 days In use
OpenAI (voice models) OpenAI OpCo, LLC Live voice models that listen and speak on calls Call audio and the text of the call United States Zero data retention where approved on our account; otherwise up to 30 days for abuse monitoring On the bench
Email
AgentMail AgentMail, Inc. Sends and receives the Agents' email Emails to and from the Agents, with their attachments, names and addresses United States. EU storage is an Enterprise feature Keeps the Agents' mailboxes until we delete them. Deleted when your account with us closes. Logs under its own retention policy. Not used to train AI models, under our data processing agreement with AgentMail In use
Nylas Nylas, Inc. Sends and receives the Agents' email Emails to and from the Agents, with their attachments, names and addresses United States, or the UK For as long as we have an account, plus two months. Logs one year On the bench
Amazon SES Amazon Web Services, Inc. Sends our own notices to Users, such as sign-in and incident emails Users' names and email addresses, and the notice's text. Our own data as controller (DPA 2.3), listed for transparency An AWS region in the EU Addresses that bounce or complain stay on a suppression list until we remove them. Otherwise under AWS's own retention policy In use
Meetings, email and documents
Fathom Fathom Video Inc. Records and transcribes our video meetings, including onboarding and support calls with your team Names, voices and video of the people in the meeting, and any Customer Personal Data discussed United States Until we delete it; deleted within 30 days of closing our account. Opted out of Fathom's use of de-identified meeting data to train its own models In use
Google Workspace Google LLC Our own email, documents, file storage and video meetings, including support emails and files your team sends us Anything your team sends us by email or shares with us, such as lists of Contacts or sites, and what is said in our meetings Google's data centres worldwide (our edition has no region choice) As long as we keep it under our terms In use
Sign-in, monitoring and network
WorkOS WorkOS, Inc. Sign-in for Users Users' names, email addresses and sign-in records. We hold these as a controller (DPA 2.3). No Contact data United States For as long as the User has an account, then under WorkOS' own retention policy In use
Pydantic Logfire Pydantic Services Inc. Traces that show how the platform is running, for finding and fixing faults Technical traces. Message content is left out and personal details are removed before traces leave our systems EU 30 days on our current plan In use
PostHog PostHog Inc. Product analytics in the web application: which features Users use Users' identifiers and the pages and features they use. No session recordings. Our own data as controller (DPA 2.3), listed for transparency EU (Frankfurt) Events 1 to 2 years, depending on plan. User profiles until we delete them In use
Cloudflare Cloudflare, Inc. Protects the Services and routes traffic to them All traffic to and from the Services passes through it, including what Users and Contacts send Its global network, nearest to each user, including outside the EU Request logs under Cloudflare's own retention policy In use

3. Not subprocessors

These do not process Customer Personal Data for us, so they are not on the list:

  • Software we run ourselves in our own cloud account: our database (PostgreSQL), SpiceDB (who may see what), LanceDB (search), our Temporal workers, our voice agent and the open-source libraries inside the Services, such as CopilotKit, whose telemetry is switched off. The hosting provider's row covers them.
  • GitHub, which holds our code. It holds no Customer Data.
  • The uptime checker, which checks from outside that the Services respond. It sees no Customer Data.
  • AI coding tools we use to build the Services, while they read only our code and made-up test data. When our staff use them on your data, the OpenAI and Anthropic rows cover them.
  • Telecoms carriers that only carry calls and messages (DPA 1.3, "Subprocessor").
  • Systems you connect to the Services yourself (Terms of Service 4.6).
  • Meta (WhatsApp Business Platform). The Agents send WhatsApp messages from a WhatsApp Business account in your name, under your own agreement with Meta (Agent and Communications Terms 4.5), so Meta processes them for you and we do not engage it. Twilio, which carries those messages for us and is on the list, also uses Meta to deliver them, in the United States. If you process data for a client, include Meta in what you tell your client.
  • Our staff chat tools. They hold no Customer Data.
  • Tools we do not use: Sentry, Graylog, Bitbucket, Pipecat, Typesense, Redis and Amazon Cognito. If we start to use one with Customer Data, we add it here first.

4. Changes

We update this list as clause 1.6 describes. Other changes to a row apply from when we publish them. Where a change lets a provider keep Customer Personal Data longer or in a new country, we give notice as clause 1.6 describes. Each version shows its effective date.