Annex 3 to the Data Processing Agreement. Controller of this document: Growthlio OÜ
Change notice: clients are notified at least 14 days before a Sub-processor is added or replaced (DPA Section 5.3).
Section 1Artificial intelligence and language models
| Sub-processor | Purpose | Data processed | Location | Engaged when |
|---|---|---|---|---|
| Anthropic PBC | Conversational agent reasoning, message generation, transcript analysis | Message content, transcripts, contact first name and qualification context | United States | All conversational services |
| OpenAI, L.L.C. | Conversational agent reasoning, classification, embeddings | Message content, transcripts | United States | Where the workflow uses OpenAI models |
| Google LLC | Gemini model inference | Message content, transcripts | United States | Where the workflow uses Gemini models |
No training on client data. All of the above are accessed through paid API tiers, under which submitted data is not used to train the provider's models. Anthropic and OpenAI API data is retained by the provider for a limited abuse monitoring period under their standard terms.
Section 2Voice and telephony
| Sub-processor | Purpose | Data processed | Location | Engaged when |
|---|---|---|---|---|
| Retell AI, Inc. | Real time voice agent orchestration, call handling | Call audio, transcripts, telephone number, contact name | United States | Voice services only |
| ElevenLabs Inc. | Text to speech voice synthesis | Generated speech text | United States | Voice services only |
| Twilio Inc. | SMS and voice carriage, telephone numbers | Telephone number, message content, call metadata, call recordings | United States | Where Twilio is the carrier |
| Telnyx LLC | SMS and voice carriage | Telephone number, message content, call metadata | United States | Where Telnyx is the carrier |
Section 3Customer relationship management
| Sub-processor | Purpose | Data processed | Location | Engaged when |
|---|---|---|---|---|
| HighLevel Inc. (GoHighLevel) | CRM of record, contact storage, conversation history, calendars, pipelines | Full contact record, message and call history, appointments, opportunity data | United States | Most engagements |
Where the Services operate inside the client's own HighLevel account, HighLevel is the client's own processor under the client's direct agreement with HighLevel, and Provider accesses it under delegated credentials. It is listed here for completeness.
Section 4Infrastructure and hosting
| Sub-processor | Purpose | Data processed | Location | Engaged when |
|---|---|---|---|---|
| Railway Corp. | Hosting of the n8n automation runtime | All data in transit through automation workflows, execution logs | United States | All engagements |
| Supabase Inc. | Application database and object storage | Contact records, transcripts, application data, uploaded files | AWS eu-west-2 (London), or the region stated in the applicable engagement | Where a custom application is delivered |
| Vercel Inc. | Application and API hosting | Data in transit through application endpoints | United States (iad1) by default | Where a custom application is delivered |
| Amazon Web Services, Inc. | Underlying infrastructure for Supabase and other Sub-processors | As above | Region as stated by the relevant Sub-processor | Indirect, via the above |
Section 5Email
| Sub-processor | Purpose | Data processed | Location | Engaged when |
|---|---|---|---|---|
| Resend, Inc. | Transactional and notification email delivery | Email address, name, message content | United States | Where transactional email is in scope |
| Instantly.ai | Outbound email campaign delivery and reply handling | Email address, name, company, message content | United States | Cold email services only |
Section 6Call recording and transcription
| Sub-processor | Purpose | Data processed | Location | Engaged when |
|---|---|---|---|---|
| Recall.ai | Meeting recording and real time transcript capture | Call audio, transcripts, participant names | United States (us-west-2) | Where live call coaching or recording is in scope |
| Fireflies.ai | Meeting transcription and summarisation | Call audio, transcripts, participant names | United States | Where meeting transcription is in scope |
Section 7Advertising platforms
| Sub-processor | Purpose | Data processed | Location | Engaged when |
|---|---|---|---|---|
| Meta Platforms, Inc. | Advertising delivery, conversion measurement, custom and lookalike audiences | Hashed email address, hashed telephone number, event data | United States | Paid media services only |
| Google LLC | Advertising delivery, conversion measurement | Hashed identifiers, event data | United States | Paid media services only |
Where audience data is uploaded to an advertising platform, the platform acts as an independent controller or joint controller for its own purposes under its own terms. The client is responsible for having a lawful basis for that upload.
Section 8Internal operations
These Sub-processors do not receive contact lists in the ordinary course, but may incidentally process Personal Data appearing in project documentation, screenshots, support requests or reporting.
| Sub-processor | Purpose | Location |
|---|---|---|
| ClickUp | Project and task management | United States |
| Slack Technologies, LLC | Client and partner communication | United States |
| Google LLC (Workspace) | Email, documents, spreadsheets, file storage | United States and EU |
| Notion Labs, Inc. | Documentation | United States |