1. How to read this list
A sub-processor is a third party we engage to process personal data on behalf of our customers. Everything below is either on the path of a live call or a necessary part of running the account around it. There are no analytics vendors, data brokers, enrichment services or lead suppliers on this list, because the product uses none.
What is not on the list matters as much as what is. There is no telephony provider, because the bots dial through the customer’s own dialer and carrier, on their caller ID, under credentials they supply and we encrypt per connection. And there is no payment processor, because invoices are paid by bank transfer, no card data exists anywhere in this product.
Each row below is described by the role it performs rather than the supplier’s trading name. The named list, with each company’s identity and the safeguards in place, goes to customers and to a buyer’s security team on request, write to [email protected]. Under the data processing agreement we notify customers before a sub-processor changes, which gives you the chance to object.
The region column describes where each provider principally operates. It is not a contractual commitment that processing is confined there: as the security page states, processing is not restricted to a single region today. If residency matters to you, raise it before you sign.
2. Current sub-processors
| Sub-processor | Purpose | Data processed | Where processed |
|---|---|---|---|
| Speech processing | Turns the caller's speech into text as the bot listens, and the bot's replies into the voice chosen for your call flow. | Call audio and the text the bot speaks. | United States |
| Conversation processing | Produces the bot's side of the call from the script, disclosure and rebuttals you supplied. | Call transcripts and the call-flow configuration built from your script. | United States, with global infrastructure |
| Object storage | Private storage for the call-flow files you send us and for the bank transfer receipts uploaded against an invoice. | Scripts and disclosures you supply, and payment proof documents you upload. | Region configured for the deployment |
| Application hosting | Runs this website, the client panel and the back office. | Everything submitted through a form or the client panel, in transit and at rest. | Region configured for the deployment |
| Email delivery (SMTP provider) | Transactional email, enquiry acknowledgements, waiting-list replies, invoices, payment confirmations and password resets. | Recipient name and email address, and the content of the message sent. | Region of the configured provider |
| Ahrefs Web Analytics | Cookieless page analytics on our public website: which pages are visited and how visitors found them. Not used in the client panel or the back office. | Page address, referring site, country and device type. No cookies and no stored IP address. | Ahrefs Pte. Ltd. infrastructure |
3. Hosting and infrastructure
The application and its database run on cloud infrastructure engaged by B3 Voice. Where that infrastructure provider or its region changes in a way that affects where customer data is stored, it is treated as a sub-processor change and notified under section 5.
4. International transfers
Where a sub-processor processes personal data outside the United Kingdom, the transfer is made under the UK International Data Transfer Agreement, or the UK Addendum to the European Commission’s standard contractual clauses, together with that provider’s own supplementary measures. The privacy policy sets out the same position for data we hold as a controller.
5. Changes and how to object
We will give customers at least 30 days’ notice by email before adding or replacing a sub-processor that handles personal data, unless the change is required urgently for security or continuity, in which case we will tell you as soon as we reasonably can.
If you have a reasonable objection on data protection grounds, tell us within those 30 days at [email protected]. We will work with you to find an alternative; where none exists, you may terminate the affected part of the service without penalty for the remainder of the term. That commitment is set out in the data processing agreement.
To be told when this page changes, email [email protected] and ask to be added to the sub-processor notification list.
Other policies