This register identifies third parties LeadLatch uses to process Customer Personal Data for the Service. It is a controlled schedule to the DPA. A planned provider is not a Subprocessor until it processes production Customer Personal Data.
1. Current Subprocessors
| Provider | Function | Customer Personal Data | Location statement | Status |
|---|---|---|---|---|
| Telnyx LLC | Telephony, call routing, recording storage, and operational SMS delivery | Phone numbers, audio, recordings, SMS contents, opt-in or opt-out commands, delivery status, and call or message provider metadata | Varies by account, service, and vendor infrastructure; no single location represented | Live |
| OpenAI, L.L.C. | Realtime voice AI and post-call transcription | Audio, conversation content, transcript inputs, and information spoken or supplied in tool context | Account endpoint and regional configuration not verified | Live |
| LiveKit, Inc. | Real-time media and agent infrastructure | Audio and session or telephony metadata | Cloud Agents and media processing locations vary; no single location represented | Live |
| Supabase, Inc. | Database and authentication | Account, configuration, Caller, transcript, booking, and authentication data | Varies by project region and vendor subprocessors | Live |
| TomTom International B.V. | Routed drive-time calculation | Origin and destination coordinates | Processing location not verified | Live |
| Dotsquare LLC d/b/a Geocodio | Address geocoding | Service address and derived coordinates | Depends on plan and vendor infrastructure; no single location represented | Live |
| Vercel Inc. | Website, dashboard, API, webhook, server-action, and recording-proxy hosting | Data transiting those application paths, including proxied audio | Varies by plan, configured regions, and subprocessors | Live |
| Upstash, Inc. | Public contact-form rate limiting | Salted contact identifier and rate-limit metadata | Varies by configured database region | Live |
| Functional Software, Inc. d/b/a Sentry | Error monitoring | Diagnostic data, operational identifiers, and possible incidental personal information after redaction | Varies by account region and subprocessors | Live |
| GitHub, Inc. | Scheduled recording ingestion and software delivery | Call audio transiently processed by GitHub Actions; source and deployment data | Varies by plan and hosted-runner location | Live |
| Plus Five Five, Inc. d/b/a Resend | Transactional Customer email | Customer recipient email plus Caller phone, service address, job details, price, and booking window when present | Vendor is a United States entity; storage and subprocessor locations may vary | Live |
| Stripe, Inc. | Customer billing and payment processing | Customer billing contact, payment method, and invoice line items describing billed call minutes and booked jobs. No Caller Data | Vendor is a United States entity; storage and subprocessor locations may vary | Live |
Stripe processes Customer billing data only. It receives no Caller Data: invoice lines describe quantities of call minutes and booked jobs, never who called, from what number, or about what.
2. Changes and objections
LeadLatch will provide at least 30 days' advance email notice when practicable before a new Subprocessor begins processing Customer Personal Data. An urgent security or continuity replacement may receive shorter or retrospective notice as promptly as practicable.
Customer may object on reasonable data-protection grounds during the notice period by emailing
privacy@leadlatch.org. The process and remedy are stated in the DPA.
3. Contact
Questions and objections: privacy@leadlatch.org