Sub-processors
Last updated: 28 October 2026
ConnectWiz processes the personal data in your workspace on your behalf, as your processor. To run the Service we engage the providers listed below (“sub-processors”). Each one receives only the data it needs for the purpose shown, under a contract that limits it to processing on our instructions.
Many providers are used only when you turn a feature on. The last column says when that is. A provider that is never switched on for your workspace never receives your data.
1. Infrastructure — always used
| Provider | Purpose | Personal data | Location | Transfer safeguard | When it is used |
|---|---|---|---|---|---|
| DigitalOcean (servers managed through Laravel Forge) | Application servers, the PostgreSQL database, the Redis cache and queues, and our self-hosted call services (web calling media, SIP gateway, WhatsApp QR bridge) | All data in the Service | United States (New Jersey) | Provider’s data processing terms with EU Standard Contractual Clauses | Always |
| Laravel Forge | Provisioning and deploying the servers above | Server configuration and deployment logs; administrative access to the servers | United States | Provider’s data processing terms; provider certified under the EU–US Data Privacy Framework | Always |
| Cloudflare | Hosting of the admin panel and the chat widget, content delivery, DNS and network protection, file storage (R2), bot checks (Turnstile) | Attachments, call recordings, avatars and other files; encrypted database backups; visitors’ IP address and browser signals | Cloudflare’s global network; R2 storage location chosen automatically by Cloudflare | Provider’s data processing terms with EU Standard Contractual Clauses | Always |
| Pusher | Real-time delivery of new messages and events to the panel, the mobile app and the website widget | Message content, contact names, event metadata | United States (Oregon, “us3” cluster) | Provider’s data processing terms with EU Standard Contractual Clauses | Always |
| Resend | Transactional e-mail: sign-in and verification messages, invitations, notifications, conversation transcripts you choose to e-mail | Recipient e-mail address, e-mail content | United States | Provider’s data processing terms with EU Standard Contractual Clauses | Always |
| OneSignal | Push notifications in the browser and the mobile app | Device identifier, user ID, contact name and a message preview of up to 120 characters | United States | Provider’s data processing terms with EU Standard Contractual Clauses | Always, for users who allow notifications |
| Sentry | Crash and error diagnostics | Technical diagnostics; personal data is scrubbed before sending and default personal-data collection is off | United States | Provider’s data processing terms with EU Standard Contractual Clauses | Always in the mobile app; on the server only while error reporting is enabled |
2. Billing, sign-in and notifications — used for specific features
| Provider | Purpose | Personal data | Location | Transfer safeguard | When it is used |
|---|---|---|---|---|---|
| Stripe | Subscription billing and wallet top-ups | Billing contact details, payment details (card data is held by Stripe, not by us) | United States | Provider’s data processing terms with EU Standard Contractual Clauses | Only on paid plans or when you top up your wallet |
| Twilio | Phone-number verification, SMS two-factor sign-in, and SMS sent through ConnectWiz’s own SMS account | Phone numbers, SMS content | United States | Provider’s data processing terms with EU Standard Contractual Clauses | Only if you use phone verification, SMS two-factor sign-in, or send SMS without connecting your own SMS provider |
| Google Firebase Cloud Messaging | Incoming-call alerts in the Android app | Device token, call notification details | Google’s global infrastructure | Google’s data processing terms with EU Standard Contractual Clauses | Only if you take calls in the Android app |
| Apple Push Notification service | Incoming-call alerts in the iPhone app | Device token, call notification details | Apple’s global infrastructure | Apple Developer Program terms (Apple offers no separate data processing terms for notifications) | Only if you take calls in the iPhone app |
| Google Maps Platform (Places API) | Suggesting nearby places when a team member shares a location in a conversation | Map coordinates chosen by the team member (rounded) | Google’s global infrastructure | Google’s controller-to-controller data protection terms with EU Standard Contractual Clauses | Only when a team member shares a location |
| 17TRACK (Vastar Singapore Technology Pte. Ltd.) | Parcel tracking for your orders | Tracking number and carrier only — never the recipient’s name, address or phone | People’s Republic of China and United States (Tencent Cloud, provider’s statement) | Being confirmed | Only if you turn on shipment tracking on ConnectWiz’s tracking account (not when you connect your own 17TRACK key); never used for a workspace with a TikTok channel |
3. Messaging channels operated by Meta
| Provider | Purpose | Personal data | Location | Transfer safeguard | When it is used |
|---|---|---|---|---|---|
| Meta Platforms (WhatsApp, Messenger, Instagram, Threads) | Sending and receiving messages, comments and calls on the Meta channels you connect; conversion events you choose to send to your own Meta dataset | Message content, attachments, contact identifiers, call media; contact identifiers in conversion events are hashed before they are sent | Meta’s global data centres (see section 6 of our Privacy Policy for WhatsApp data residency) | Meta’s business terms and Data Transfer Addendum | Only for the Meta channels you connect |
Meta also processes WhatsApp Business data as your own processor under Meta’s business terms. Section 6 of our Privacy Policy explains the processing chain, the encryption model and Meta’s retention.
4. AI, voice and search — only when you use ConnectWiz’s keys
AI features are off until a workspace turns them on. The providers below are our sub-processors when a feature runs on ConnectWiz’s own account with that provider (the “platform key”). We do not permit them to use your content to train their models, except where a row says otherwise.
| Provider | Purpose | Personal data | Location | Transfer safeguard | When it is used |
|---|---|---|---|---|---|
| OpenAI | AI replies and suggestions, knowledge-base search (embeddings), speech-to-text, text-to-speech, live voice agents, image editing | Conversation text and history, knowledge-base content, call and voice-note audio, images | United States | Provider’s data processing terms with EU Standard Contractual Clauses | Only if AI features run on ConnectWiz’s OpenAI key |
| Anthropic | AI replies and suggestions | Conversation text and history, knowledge-base content | United States | Provider’s data processing terms with EU Standard Contractual Clauses | Only if you choose an Anthropic model on ConnectWiz’s key |
| Google (Gemini API) | AI replies and suggestions; image editing and the content-safety check in Image Studio | Conversation text and history, images | Google’s global infrastructure | Google’s data processing terms with EU Standard Contractual Clauses | Only if you choose a Gemini model on ConnectWiz’s key, or use Image Studio |
| xAI | AI replies and suggestions | Conversation text and history | United States | Provider’s data processing terms with EU Standard Contractual Clauses | Only if you choose an xAI model on ConnectWiz’s key |
| Deepgram | Speech-to-text for calls and voice notes | Call and voice-note audio, transcripts | United States | Being confirmed | Only if you use voice calls or voice transcription with Deepgram |
| ElevenLabs | Synthetic voices for voice agents | Text the agent speaks; call audio during a voice-agent session | United States (provider’s default storage region) | Provider’s data processing terms with EU Standard Contractual Clauses | Only if you choose an ElevenLabs voice |
| Cartesia | Synthetic voices for voice agents | Text the agent speaks | United States | Provider’s data processing terms with EU Standard Contractual Clauses | Only if you choose a Cartesia voice |
| Magnific (Magnific AI, S.L.U., formerly Freepik Company) | Image editing in Image Studio | Photos sent in a conversation, the editing instruction | European Union (Spain, provider’s establishment); processing location being confirmed | Being confirmed | Only if you turn on Image Studio |
| fal | Image editing in Image Studio | Photos sent in a conversation, the editing instruction | United States and other countries (provider’s statement) | Provider’s data processing terms with EU Standard Contractual Clauses | Only if Image Studio uses fal |
5. Services you connect yourself
Some services receive data because you connect them to your workspace with your own account, credentials or API key. When you do, we send data to them on your instruction. They are recipients you choose and contract with, not our sub-processors, and their own terms and privacy policies govern what they do with it. Examples:
- Messaging and social channels: Telegram, X, TikTok, LinkedIn, Viber, LINE, Zalo, WhatsApp through QR pairing.
- Google accounts: Gmail, Google Calendar, YouTube, Google Business Profile and Google Ads.
- Your own e-mail, SMS and phone lines: your mailbox, your own SMS provider (for example Netgsm, Verimor, İleti Merkezi or Twilio on your account), your SIP or GSM lines, and İYS.
- Marketplaces and stores: Trendyol, Hepsiburada, Amazon, eBay, Etsy, Çiçeksepeti, Pazarama, idefix, PttAVM, n11, Mirakl marketplaces, Shopify, WooCommerce, ikas, Ticimax, IdeaSoft, App Store and Google Play reviews.
- CRM, booking, payment and other business tools: HubSpot, Zendesk, Slack, Airtable, Mailchimp, Brevo, Calendly, Stella, Paraşüt, iyzico, PayTR, and webhooks or HTTP APIs you configure.
- Your own AI, voice, search or image keys: when you connect your own key for any provider listed in section 4 — or for a provider offered only with your own key, such as Meta’s AI models or Google Programmable Search — that provider processes the data under your contract with it.
- Your own parcel-tracking key: when you connect your own 17TRACK key, tracking numbers go to 17TRACK under your account.
- The tags on your own website: when the ConnectWiz tag manager loads your Google Analytics, Google Ads, Meta Pixel, TikTok Pixel, LinkedIn Insight Tag, Microsoft Clarity, Microsoft Advertising, Yandex Metrica or OpenAI tags with your ids, your visitors’ browsers send data straight to those providers under your accounts, and only after the visitor allows that category in your cookie banner.
6. International transfers
Most sub-processors process data outside Türkiye and outside the European Economic Area. For customers in the EEA, Switzerland and the United Kingdom, transfers rely on the EU Standard Contractual Clauses (with the UK Addendum) in our data processing agreement and in each provider’s terms. For customers in Türkiye, transfers abroad rely on the standard contract published by the Personal Data Protection Board under Article 9 of Law No. 6698 (KVKK). Where a row says “being confirmed”, we are still verifying the location or safeguard with the provider and will update this page.
7. Changes to this list
We notify workspace owners by e-mail at least 30 days before we add or replace a sub-processor. If you have a reasonable data-protection objection, tell us within that period at [email protected]; we will work with you to address it, and if we cannot, you may stop using the affected feature or end your subscription, and we refund the unused part of any prepaid fees.
Removing a sub-processor takes effect without notice. The “last updated” date at the top of this page changes with every update.
8. Contact
Questions about this list, or a signed copy of our Data Processing Agreement (app.connectwiz.net/dpa): [email protected]. See also our Privacy Policy and Terms of Service.