We will update this page before adding or replacing a sub-processor. Customers who have told us they want change notifications will be emailed at least 30 days in advance, and may object under their DPA.
| Provider | What it does for us | Data it can reach | Location | Safeguard for non-UK |
|---|---|---|---|---|
| ElevenLabs | Speech recognition and speech synthesis for the voice agent | Call audio and transcripts, in real time | United States | IDTA / UK Addendum |
| OpenAI & Anthropic | Generate the agent’s responses during a call | Call transcript content | United States | IDTA / UK Addendum |
| Amazon Web Services (AWS) | Application database and file storage — recordings, transcripts, leads | All customer and call data | United Kingdom (London region) | AWS UK Data Processing Addendum |
| Resend | Sends transactional email — notifications, receipts | Customer name and email address | United States | IDTA / UK Addendum |
| Stripe | Payment processing and billing | Customer name, email, billing address, payment records. We never receive full card numbers. | United States / Ireland | Stripe’s own transfer terms |
| Sentry | Error monitoring | Technical logs; may incidentally include identifiers | United States | IDTA / UK Addendum |
| Conovo Ltd staff | Operate and support the service, investigate faults | Customer account data, and call recordings and transcripts where support requires it | United Kingdom | — |
| Google (GA4) | Website analytics (marketing site only, consent-based) | Website usage data | United States | Google’s transfer terms |
| Microsoft Clarity | Website session analytics (marketing site only, consent-based) | Website usage data | United States | Microsoft’s transfer terms |
Telephony carrier: our UK telephony provider — who supplies phone numbers and carries calls and SMS — is being finalised. We will name them here, with their location and safeguard, before the service goes live.
Not sub-processors: the phone networks that carry a call before it reaches us act as independent controllers or as their own operators, not on our instructions.
The analytics providers (GA4, Microsoft Clarity) are used only on the marketing website, only with consent, and never touch call data.