Legal
Sub-processors
These are the companies and people who process your customers' personal data on our behalf. Each is bound by a data processing agreement imposing obligations equivalent to the ones we owe you, and we remain responsible to you for what they do.
This page forms Annex III of our Data Processing Agreement. It lives here, rather than inside that document, so it stays accurate — adding a sub-processor means editing this page, and doing so follows the notice procedure in clause 6: 15 days' notice before a new one starts, and 10 days for you to object.
This list covers your customers' data. Companies that only touch visitors to our own website — fonts, analytics, advertising — are not sub-processors of your data, and are listed in our privacy policy and cookie policy instead.
Infrastructure
The platform itself and the machines it runs on.
| Sub-processor | What it does | Personal data | Location |
|---|---|---|---|
| Railway | Hosts the conversation platform, its database, background workers and the AI service | Contacts, conversations, message content, attachments | United States |
| Vercel | Hosts the dashboard application | Request logs; a private store holding derived totals only, with no identifiers | United States |
Channels and features
Used only where you have enabled the feature concerned.
| Sub-processor | What it does | Personal data | Location |
|---|---|---|---|
| Twilio | Delivers and receives SMS and WhatsApp messages | Telephone numbers, message content | United States |
| Amazon Web Services (SES) | Sends outbound email | Email addresses, message content | Ireland |
| Translates message content, detects the language of incoming messages, and powers Store AI, which reads your store's order and customer information to answer your team | Message content; for Store AI, order and customer information: name, email address, telephone number, postal address and order history | Global. Content is not used to train models. Logged briefly for abuse detection and may be cached transiently in other countries | |
| Reads your own analytics property to build reports, where you have connected one | Aggregated figures, not individual records | Global | |
| Shopify, WooCommerce or Medusa | Your own store platform. We query it for order and customer information so that it can be shown alongside a conversation | Name, email address, telephone number, postal address | Where your store is hosted. Fetched per request, displayed, and discarded — never stored by us |
Our people
On the Managed plan, the staff who answer your customers are the means by which the processing happens, so they are listed here for the same reason a vendor is.
| Sub-processor | What they do | Personal data | Location |
|---|---|---|---|
| Re: Caffeinate managed staff | Read and answer your customers' messages on your behalf, and carry out the order actions you have authorised | Everything present in a conversation | United States, United Kingdom, Brazil, South Korea |
Our managed staff are contractors. Each is individually bound by written confidentiality and data protection obligations that survive the end of their engagement, and each one's access is controlled by inbox membership, checked on every request.
Transfers
Most processing above happens in the United States, which does not have a UK adequacy decision. Those transfers are made under the UK International Data Transfer Addendum, the EU Standard Contractual Clauses with the UK Addendum, or — where a provider is certified — the UK Extension to the EU–US Data Privacy Framework. We hold transfer risk assessments and will share the relevant one on request.
Changes to this page
| Date | Change |
|---|---|
| 16 September 2026 | First published. |
| 26 October 2026 | Google's row now includes Store AI. The store platform row now names Shopify, WooCommerce and Medusa. |
To be told when this page changes, and we will add you to the notification list.
Last updated 26 October 2026.