Current Sub-Processors
We require every Sub-processor to be under a data protection agreement meeting GDPR Article 28, and we remain responsible to you for what they do. Where data goes outside the EEA, the safeguards are set out in Section 14 of our Terms.
Messaging
WhatsApp Business API and Cloud API, Instagram Graph API, Messenger
Telegram channel — messages and contact identities on the Telegram accounts you connect
TikTok channel — messages and contact identities on the TikTok accounts you connect
WhatsApp Business API delivery and phone number provisioning. SMS is delivered through your own connected Twilio account, where Twilio is not our Sub-processor
Phone numbers you rent through the app — provisioning the number (your business name and address and, where telecom regulation requires it, identity documents supplied for the order) and the calls and texts received on that number, which we read to complete WhatsApp verification. Numbers you bring from your own Twilio account do not involve Telnyx
Email channel delivery through our own system account, sent from Mailgun's EU region. Where you connect your own Mailgun or SMTP credentials, delivery runs on your account and Mailgun is not our Sub-processor for that traffic
Lifecycle and product email to account holders — your own account email address and subscription events, not your contacts' data
AI
AI processing — conversations, helper tasks, transcription, image and video understanding and generation, embeddings and knowledge-base processing — depending on how requests are routed
AI processing — conversations, helper tasks, transcription, image and video understanding and generation, embeddings and knowledge-base processing — depending on how requests are routed; plus Google Cloud services behind the app (Maps and Places lookups, analytics storage) and Calendar and Drive when you connect them
AI processing — conversations, helper tasks, transcription, image and video understanding and generation, embeddings and knowledge-base processing — depending on how requests are routed
AI processing — conversations, helper tasks, transcription, image and video understanding and generation, embeddings and knowledge-base processing — depending on how requests are routed
AI processing — conversations, helper tasks, transcription, image and video understanding and generation, embeddings and knowledge-base processing — depending on how requests are routed
AI processing — conversations, helper tasks, transcription, image and video understanding and generation, embeddings and knowledge-base processing — depending on how requests are routed
AI processing — conversations, helper tasks, transcription, image and video understanding and generation, embeddings and knowledge-base processing — depending on how requests are routed
AI processing — conversations, helper tasks, transcription, image and video understanding and generation, embeddings and knowledge-base processing — depending on how requests are routed
AI processing — conversations, helper tasks, transcription, image and video understanding and generation, embeddings and knowledge-base processing — depending on how requests are routed
AI processing — conversations, helper tasks, transcription, image and video understanding and generation, embeddings and knowledge-base processing — depending on how requests are routed
AI processing — conversations, helper tasks, transcription, image and video understanding and generation, embeddings and knowledge-base processing — depending on how requests are routed
AI processing — conversations, helper tasks, transcription, image and video understanding and generation, embeddings and knowledge-base processing — depending on how requests are routed
AI processing — conversations, helper tasks, transcription, image and video understanding and generation, embeddings and knowledge-base processing — depending on how requests are routed
AI processing — conversations, helper tasks, transcription, image and video understanding and generation, embeddings and knowledge-base processing — depending on how requests are routed
Speech processing — transcribing voice notes and call recordings, generating spoken replies, running live AI voice calls and creating cloned voices from voice samples the Customer provides — depending on how requests are routed
Speech processing — transcribing voice notes and call recordings, generating spoken replies, running live AI voice calls and creating cloned voices from voice samples the Customer provides — depending on how requests are routed
Speech processing — transcribing voice notes and call recordings, generating spoken replies, running live AI voice calls and creating cloned voices from voice samples the Customer provides — depending on how requests are routed
AI processing — conversations, helper tasks, transcription, image and video understanding and generation, embeddings and knowledge-base processing — depending on how requests are routed
AI processing — conversations, helper tasks, transcription, image and video understanding and generation, embeddings and knowledge-base processing — depending on how requests are routed
Payments
Payment processing
Payment processing where PayPal is offered as a payment method, and partner payouts. Where an agency connects its own PayPal account to bill its clients, PayPal is not our Sub-processor for that traffic
Infrastructure
EU dedicated server hosting for our application, database and WhatsApp Web service
CDN, DNS and network protection in front of our websites and API. Traffic passes through Cloudflare in transit. Also provides cookie-free aggregate traffic-source measurement for our public website
Message and task queues (Pub/Sub and Cloud Tasks), whose payloads can carry message and contact identifiers; encrypted database backups in Google Cloud Storage; specific Cloud Functions; and, while it is being retired, legacy database storage (Firestore) holding earlier copies of contacts and messages. Pub/Sub stores messages in transit in the Google region nearest the server that publishes them
Account sign-in (Firebase Authentication, a global service that is not pinned to one region) and file storage in the EU multi-region
Integrations
Connects your own third-party app accounts to automations and custom functions: runs app actions and receives those apps' events for app event triggers
Fetches public web pages for knowledge base and FAQ import, for prospect research in Find Leads, and to look up a new contact's public website or profile before an AI agent's first reply (when that setting is on)
Find Leads — checks whether a prospect's email address is deliverable before it is shown to you
Restaurant reservation integration — receives a contact's name, email and phone to create or cancel a booking
Restaurant reservation integration — receives a contact's name, email and phone to create or cancel a booking
Restaurant reservation integration — receives a contact's name, email and phone to create, change or cancel a booking
Find Leads — checks whether a prospect's email address is deliverable and enriches prospect and company details, depending on how requests are routed
Find Leads — checks whether a prospect's email address is deliverable and enriches prospect and company details, depending on how requests are routed
Find Leads — checks whether a prospect's email address is deliverable and enriches prospect and company details, depending on how requests are routed
Find Leads — checks whether a prospect's email address is deliverable and enriches prospect and company details, depending on how requests are routed
Connectivity
Residential and ISP proxies that carry the connection to a platform you connect (WhatsApp Web, LinkedIn) so it comes from a stable, local IP address, improving connection reliability
Residential and ISP proxies that carry the connection to a platform you connect (WhatsApp Web, LinkedIn) so it comes from a stable, local IP address, depending on how connections are routed
Residential and ISP proxies that carry the connection to a platform you connect (WhatsApp Web, LinkedIn) so it comes from a stable, local IP address, depending on how connections are routed
Residential and ISP proxies that carry the connection to a platform you connect (WhatsApp Web, LinkedIn) so it comes from a stable, local IP address, depending on how connections are routed
Residential and ISP proxies that carry the connection to a platform you connect (WhatsApp Web, LinkedIn) so it comes from a stable, local IP address, depending on how connections are routed
Residential and ISP proxies that carry the connection to a platform you connect (WhatsApp Web, LinkedIn) so it comes from a stable, local IP address, depending on how connections are routed
Residential and ISP proxies that carry the connection to a platform you connect (WhatsApp Web, LinkedIn) so it comes from a stable, local IP address, depending on how connections are routed
Residential and ISP proxies that carry the connection to a platform you connect (WhatsApp Web, LinkedIn) so it comes from a stable, local IP address, depending on how connections are routed
Residential and ISP proxies that carry the connection to a platform you connect (WhatsApp Web, LinkedIn) so it comes from a stable, local IP address, depending on how connections are routed
Residential and ISP proxies that carry the connection to a platform you connect (WhatsApp Web, LinkedIn) so it comes from a stable, local IP address, depending on how connections are routed
Residential and ISP proxies that carry the connection to a platform you connect (WhatsApp Web, LinkedIn) so it comes from a stable, local IP address, depending on how connections are routed
Diagnostics
Application error and performance monitoring for our web dashboard and backend services, including the error details and request context of a failed operation. Diagnostic data only, IP anonymised, no session recording. Data is ingested and stored in the EU region; the entity is US-based
Get Notified of Changes
Add your email and we'll tell you 14 days before any new Sub-processor starts handling your data. Nothing else — this list is only ever used for these notices, and you can unsubscribe from any of them.
How Changes Work
You gave us general authorisation to use Sub-processors when you accepted our Terms, so we don't need a new signature each time this list changes. What we owe you instead is notice and a say.
Before a new Sub-processor begins processing your data, we tell you at least 14 days ahead, by email or in-app notice and by publishing it on this page. If you object on reasonable data-protection grounds, we'll work with you to find a commercially reasonable solution. If we can't find one within 30 days, you can terminate the affected Services without penalty.
This is set out in full in Section 14 of our Terms of Service, which is also our Data Processing Agreement. If you need a counter-signed copy for a compliance review, you can download one here.
Reach our team at hi@dmchamp.com and we will respond within two business days.
