Sub-processors

These are the companies IzzyOS LLC uses to run the service that may handle personal data you put into IzzyOS. This list is Annex III of the Data Processing Agreement.

How we choose and bind them

Each sub-processor is bound by a written contract that protects personal data at least as well as our Data Processing Agreement requires, to the extent the service it provides allows. We remain responsible to you for their work.

Changes and your right to object

We tell account owners at least 30 days before we add or replace one, by updating this list and emailing the account owner. You can object on reasonable data protection grounds by emailing privacy@izzyos.com within that notice period, as section 5.4 of the Data Processing Agreement describes.

Where a location says "Not confirmed", we have not been able to confirm it from the provider, and we will update it when we do.

Sub-processors

Supabase

• What it does: Main database, sign-in, file storage and background jobs.
• Personal data it handles: All account and contact data stored in IzzyOS.
• Where it processes data: United States, AWS US West (Oregon).
• Their terms: supabase.com/legal/dpa

Vercel

• What it does: Hosts the IzzyOS app and the pages and funnels it publishes.
• Personal data it handles: Page requests, IP addresses, and data passing through the app on its way to the database.
• Where it processes data: United States. App functions run in Washington, D.C. (iad1); static files are served from Vercel's global network.
• Their terms: vercel.com/legal/dpa

Anthropic

• What it does: AI model behind Kai: writing, planning and answering.
• Personal data it handles: Prompts and context Kai sends, which can include contact names, messages and business details.
• Where it processes data: United States.
• Their terms: www.anthropic.com/legal/data-processing-addendum

OpenAI

• What it does: AI models for some features: images, transcription, search embeddings and some text generation.
• Personal data it handles: Prompts, text, images and audio sent for those features.
• Where it processes data: United States.
• Their terms: openai.com/policies/data-processing-addendum/

Google (Gemini API and Vertex AI, including Veo)

• What it does: AI text, image and video generation.
• Personal data it handles: Prompts and images sent for generation.
• Where it processes data: Not confirmed. Google does not name one country for these services.
• Their terms: cloud.google.com/terms/data-processing-addendum

Twilio

• What it does: Text messages and phone numbers.
• Personal data it handles: Phone numbers, message content and delivery status.
• Where it processes data: United States.
• Their terms: www.twilio.com/en-us/legal/data-protection-addendum

Retell AI

• What it does: AI voice calls, inbound and outbound.
• Personal data it handles: Phone numbers, call audio, transcripts and call details.
• Where it processes data: Not confirmed. Retell is a US company.
• Their terms: trust.retellai.com

Resend

• What it does: Sends email for IzzyOS and for each account.
• Personal data it handles: Email addresses, email content, and delivery, open and click events.
• Where it processes data: United States, AWS us-east-1.
• Their terms: resend.com/legal/dpa

Apify

• What it does: Reads public web pages and public social profiles for research.
• Personal data it handles: Web addresses and public page content, which can include names and public posts.
• Where it processes data: Not confirmed. Apify is based in the Czech Republic (EU).
• Their terms: docs.apify.com/legal/data-processing-addendum

ElevenLabs

• What it does: AI voices and voice cloning.
• Personal data it handles: Text to be spoken and voice samples the account owner uploads.
• Where it processes data: Not confirmed.
• Their terms: elevenlabs.io/dpa

HeyGen

• What it does: AI video avatars.
• Personal data it handles: Photos and video of the account owner and the scripts the avatar reads.
• Where it processes data: Not confirmed.
• Their terms: www.heygen.com/policy

Zernio (Late)

• What it does: Publishes and schedules social media posts.
• Personal data it handles: Post content and the connected social accounts.
• Where it processes data: Not confirmed.
• Their terms: zernio.com/privacy-policy

Higgsfield

• What it does: AI images and video for the AI influencer feature.
• Personal data it handles: Photos of the account owner and prompts.
• Where it processes data: Not confirmed.
• Their terms: higgsfield.ai/privacy-policy

Jina AI

• What it does: Reads web pages for research and brand setup.
• Personal data it handles: Web addresses and page content.
• Where it processes data: Not confirmed.
• Their terms: jina.ai/legal

Stripe

• What it does: Payments and subscriptions.
• Personal data it handles: Name, email, billing address and payment details. Card numbers stay with Stripe.
• Where it processes data: United States.
• Their terms: stripe.com/legal/dpa

Sentry

• What it does: Error monitoring.
• Personal data it handles: Error reports, which can include a user id, IP address and the page or request that failed.
• Where it processes data: United States (Sentry US region).
• Their terms: sentry.io/legal/dpa/

Services you connect yourself

These are used only when you connect your own account. The data goes to your own account at that service, under your agreement with it.

Google (Calendar, Gmail, Drive)

• What it does: Reads availability, books meetings, and reads mail and files the owner connects.
• Personal data it handles: Calendar events and attendees, emails and files the owner connects.
• Where it processes data: Set by the owner's Google account.
• Their terms: cloud.google.com/terms/data-processing-addendum

Meta (Conversions API)

• What it does: Sends lead and purchase events to the owner's Meta pixel.
• Personal data it handles: Hashed email and phone, IP address and browser details of the lead.
• Where it processes data: Set by Meta.
• Their terms: www.facebook.com/legal/terms/dataprocessing

Fathom

• What it does: Imports the owner's call recordings and notes.
• Personal data it handles: Meeting transcripts, summaries and attendee names.
• Where it processes data: Set by Fathom.
• Their terms: fathom.video/privacy

Follow Up Boss

• What it does: Syncs contacts with the owner's CRM.
• Personal data it handles: Contact details and activity.
• Where it processes data: Set by Follow Up Boss.
• Their terms: www.followupboss.com/privacy

Slack and Telegram

• What it does: Sends Kai's updates to the owner.
• Personal data it handles: Message content, which can include contact names.
• Where it processes data: Set by Slack or Telegram.

GitHub

• What it does: Syncs documents the owner connects into their knowledge base.
• Personal data it handles: Repository content the owner selects.
• Where it processes data: Set by GitHub.
• Their terms: docs.github.com/en/site-policy/privacy-policies/github-data-protection-agreement

Contact us

Questions about this list: privacy@izzyos.com, or IzzyOS LLC, 1309 Coffeen Avenue, Suite 1200, Sheridan, Wyoming 82801, USA. Legal notices: legal@izzyos.com.