Subprocessors

These are the companies that process personal information for TuaniBiz while we provide our service: our "subprocessors" for the information we handle for the businesses that use TuaniBiz, and our service providers for the information we handle on our own account. For each, we list what it does for us, what personal information it receives, and where it processes it. "To be confirmed" means we have not yet confirmed that detail with the provider.

We update this page before we add or replace a subprocessor, and tell account owners by email as our Data Processing Addendum describes.

Hosting and storage

Vercel

• What it does: hosts our website, our dashboards and every website we host, including those on businesses' own domains, and runs our server code.
• Personal information: everything sent to or from our service passes through it, including IP addresses, browser details and form, chat and booking content; it keeps request logs.
• Where: United States (San Francisco region), with a worldwide delivery network.

Supabase

• What it does: our database, sign-in for our affiliate portal, and a sign-in record for each paying customer.
• Personal information: everything we store: accounts, team members, a business's customers, bookings, quotes and payment records, messages, call transcripts and logs.
• Where: to be confirmed.

Cloudflare

• What it does: stores files (website images and uploads, website snapshots, documents a business adds to its assistant's knowledge, dispute evidence, and, in private storage, team chat photos, videos and voice notes); runs our DNS; registers the domains we buy for businesses (it receives only the domain name); serves some page libraries to visitors; and, through Cloudflare Web Analytics, may count visits to our own public pages without cookies.
• Personal information: the content of those files, which can include personal information, and the IP address and browser details of visitors who load them.
• Where: worldwide.

Railway

• What it does: hosts the server that connects phone calls to the AI receptionist.
• Personal information: call audio and caller ids while calls are in progress, and the phone numbers calls are transferred to.
• Where: United States (San Francisco region).

Artificial intelligence

OpenAI

• What it does: writes the replies of the website chat and the Facebook and Instagram assistant; speaks and listens for the AI receptionist and for calls to a business's team; writes call transcripts, summaries and translations; reads documents a business adds to its assistant's knowledge; powers Tuani IA, our support assistant and our sales follow-up assistant; sorts social media comments; creates and edits images; drafts the response to a disputed payment; and helps analyze security events.
• Personal information: the content of conversations, including any name, phone number, email or address people type or say; call audio, the caller's number and, when known, their name and upcoming appointment; a disputed payment's evidence, including the customer's contact details and the IP addresses and browsers used; IP addresses and account ids in security events; our sales conversations with businesses; and photos a business provides.
• Where: United States.

Google (Gemini API)

• What it does: writes website text and page designs, helps choose photos, and writes marketing copy; also powers an internal assistant our staff use.
• Personal information: business information, including team members' names; the text and authors' names of a business's Google reviews, in one page-design path; business photos, which can show people; and, in our internal assistant, the contact details of businesses we work with.
• Where: worldwide. [To be completed by the owner: confirm that our Gemini API key is on a paid plan, under which Google does not use this content to improve its products.]

xAI

• What it does: a backup voice for the AI receptionist when the main one is unavailable, and a voice preview for business owners.
• Personal information: when used, call audio and the same caller details as above.
• Where: United States.

ElevenLabs

• What it does: our former voice provider, still connected to some older receptionist setups.
• Personal information: business information, team members' names and the business's forwarding number; transcripts of calls answered by those setups.
• Where: United States.

Calls, texts, email and notifications

Telnyx

• What it does: our main phone carrier: the AI receptionist's phone numbers, transfers, and emergency alert calls to a business's team.
• Personal information: call audio, caller ids, team members' phone numbers, and the caller's name and reason when an alert reads them out.
• Where: United States.

Twilio

• What it does: sends one-time verification codes by text or voice call, sends texts when our main texting provider cannot, and carries some older phone lines.
• Personal information: phone numbers, codes and message content; call audio on older lines.
• Where: United States.

Zoom (Zoom Phone)

• What it does: sends and receives our text messages (demo and sales texts, payment reminders and alerts to business owners) and carries our sales team's calls, including their recordings and transcripts.
• Personal information: phone numbers, message content, and sales call recordings and transcripts.
• Where: United States.

Resend

• What it does: delivers our emails: messages the receptionist took, emails an owner asks the receptionist to send, confirmations, affiliate sign-in codes and alerts.
• Personal information: email addresses and the content of those emails.
• Where: United States.

Web push services (Google, Apple and Mozilla)

• What they do: deliver the notifications owners and staff turn on to their devices.
• Personal information: the content is encrypted end to end, so they see only the device's address and the time and size of each notification.
• Where: worldwide.

Payments and Google services

Stripe

• What it does: bills our subscriptions; processes the card payments a business takes from its customers, on the business's own Stripe account; pays our affiliates; and receives the evidence a business sends when a payment is disputed.
• Personal information: owners' names, emails and cards; customers' emails and what they paid for; dispute evidence, including addresses and the IP addresses and browsers used; and the identity and bank details Stripe collects for payouts.
• Where: United States and worldwide.

Google Maps Platform (Places)

• What it does: finds a business when someone signs up or searches on our website, provides business details and public reviews shown on the websites we build, and helps us find businesses to contact.
• Personal information: the search typed in; reviewers' public names, photos and review text; and the public details of businesses.
• Where: worldwide.

Google Business Profile, Search Console and Site Verification

• What they do: let owners who connect their Google account see their Google performance and publish approved changes, and let our own Google account register the websites we host in Search Console.
• Personal information: the connected Google account's email and access tokens, website addresses and search data.
• Where: worldwide.

Google Calendar

• What it does: an older booking path can add an appointment to our calendar, which can send the customer an email invitation.
• Personal information: the customer's name, phone number, email and booking notes.
• Where: worldwide. [To be completed by the owner: whether this older path is active.]

Other

Public content networks (unpkg.com, cdn.tailwindcss.com, cdnjs.cloudflare.com and images.unsplash.com)

• What they do: serve icons, page libraries and some stock images that visitors' browsers load on the websites we host.
• Personal information: visitors' IP addresses and browser details.
• Where: worldwide.

n8n workflow server (hosted by Hostinger)

• What it does: an old test page on our website still sends its form to this server.
• Personal information: the name, email, mobile number and business details typed into that form.
• Where: to be confirmed. [To be completed by the owner: remove the old test page and delete what this server stored.]

Services a business chooses

These receive information because a business connects or turns them on. They are not our subprocessors: the business chooses them, and its own agreement with each applies.

• Meta (Facebook and Instagram), for the accounts a business connects.
• The business's own Google account and Google Analytics property. On the websites we host, Google Analytics runs only if the business connected it and the visitor allowed analytics, and never under Global Privacy Control.
• Google Maps, embedded on some website layouts, which loads from Google.
• AI assistants a business connects to its dashboard, such as ChatGPT, Claude, Grok or Gemini.
• Stripe, for a business's own card payments, under the business's own Stripe agreement.
• Your browser's speech service, if you use the microphone in a website's chat.

Questions

Write to dennis@tuanibiz.com.