Sub-processors

1. What this list is

These are the companies we use, with our own accounts, to run Commstate. Each receives only what its service needs. The Data Processing Addendum explains how we choose them and how we tell you about changes.

Services a business connects itself, with its own account, are not on this list; they are listed separately in section 4 so you know where the data goes.

For each one we give where it processes data. When personal data from the EEA, the UK or Switzerland goes to a country without an adequacy decision, the transfer is covered by the Standard Contractual Clauses (with the UK Addendum) or by the provider's EU-US Data Privacy Framework certification, as described in the Data Processing Addendum. {{SUBPROCESSOR_TRANSFER_MECHANISMS}}

2. Always used

Hosting: {{HOSTING_PROVIDER}}

• What for: the servers Commstate runs on, including its database.
• Data: everything stored in Commstate.
• Where: {{HOSTING_COUNTRY}}.

Monitoring server: {{MONITORING_HOST_PROVIDER}}

• What for: service logs and system measurements, sent over an encrypted private network (Tailscale).
• Data: technical logs, which can include IP addresses, email addresses and record identifiers.
• Where: {{MONITORING_HOST_COUNTRY}}.

Backblaze, Inc. (B2 storage)

• What for: uploaded files, call recordings, and database backups (every six hours, kept about 14 days).
• Data: files and recordings; a full copy of the database in the backups.
• Where: United States.

Cloudflare, Inc.

• What for: the domain name service, sign-up protection (Turnstile), and storage of shop pictures and videos where enabled.
• Data: domain names; the sign-up visitor's IP address and browser signals; shop media.
• Where: global network; storage location {{R2_LOCATION}}.

{{EMAIL_PROVIDER}} (email delivery)

• What for: sending Commstate's own emails: invitations, password resets, codes, alerts and notices.
• Data: recipient address and the email's content.
• Where: {{EMAIL_PROVIDER_COUNTRY}}.

APITxT (one-time codes)

• What for: sending sign-in and verification codes by SMS, WhatsApp or voice call.
• Data: phone number and the code message.
• Where: India.

Google (Firebase Cloud Messaging) and Expo (650 Industries, Inc.)

• What for: push notifications to the Commstate mobile app.
• Data: the device's push token and the notification's title and text.
• Where: United States.

Razorpay Software Private Limited

• What for: paying for Commstate (account top-ups).
• Data: the payment amount, your business's details and contact; your card or bank details go to Razorpay directly, not to us.
• Where: India.

TrackParcel (trackparcel.in)

• What for: looking up India Post shipment tracking.
• Data: tracking numbers.
• Where: India.

ip-api.com

• What for: showing a business the approximate location of a live-chat visitor.
• Data: the visitor's IP address.
• Where: {{IP_API_COUNTRY}}.

OpenStreetMap Foundation (Nominatim)

• What for: finding the map position of post offices and courier facilities.
• Data: facility addresses only, no personal data.
• Where: United Kingdom and the Netherlands.

3. Used when we provide the AI or speech service

Businesses can use Commstate's AI features with our account or connect their own provider key. When ours is used, the request goes to one of the providers below. What is sent is what the feature needs: the conversation or message being answered, order and product details it refers to, knowledge articles, call audio or an image.

• OpenRouter, Inc., which routes requests to the model chosen (United States).
• Google LLC (Gemini models, live voice, text-to-speech) (United States).
• OpenAI, L.L.C. (models, image editing, speech-to-text, text-to-speech, embeddings) (United States).
• Anthropic, PBC (models) (United States).
• Mistral AI (speech-to-text) (France).
• ElevenLabs (text-to-speech) (United States).
• Typesafe.ai (decision models) ({{TYPESAFE_COUNTRY}}).

{{CONFIRM_LIVE_AI_PROVIDERS}}

4. Services a business connects itself

These run on the business's own account with the provider. The business chooses them and its agreement with the provider applies. We send them only what the feature the business turned on needs.

• Shopify and WooCommerce: the business's store; orders, customers and products are synced.
• Razorpay (the business's own account): payment links and shop payments.
• Meta (WhatsApp Business Platform): the business's WhatsApp messages with its customers.
• Plivo: the business's calls and SMS, including call audio and recordings.
• Resend or the business's own mail server: the business's email channel.
• Couriers, including India Post: shipment details.
• Google, Facebook, Apple, Microsoft: "sign in with" on the business's shop, using the business's own app where it has one.
• Google Analytics, Google Tag Manager, Meta Pixel: tags a business may add to its shop, loaded only after the shopper accepts the shop's cookie banner.
• Any AI provider whose key the business connects.

The business's shop pages also load fonts from Google Fonts, which sees the shopper's IP address.

5. Changes

When we add or replace a sub-processor, we publish a new version of this list at its own address and tell account owners at least {{SUBPROCESSOR_NOTICE_DAYS}} days before it starts receiving data.