Subprocessor List
Last updated: November 3, 2026 · Version 1.0
How we notify changes
We give at least 30 days' notice before adding or replacing a subprocessor that handles client data, by email to the contacts each business names. You may object under DPA Section 4.3. To subscribe, email legal@zoeyos.com with the subject "Subprocessor updates."
A. Subprocessors in use
| Subprocessor | What it does for Zoey | Services | Data it handles | Location |
|---|---|---|---|---|
| DigitalOcean, LLC | Cloud servers, managed app hosting, server snapshots | All | All data stored by the Services (hosted on our servers there) | to confirm: United States — confirm regions per server |
| Cloudflare, Inc. | Network, DNS, TLS, DDoS and WAF; secure tunnels to our servers; staff sign-in gate; hosting for the website and app front ends; encrypted backup storage and media storage (R2) | All | Network traffic; encrypted backups; stored media and call recordings where enabled | to confirm: Global network; R2 location — confirm |
| Twilio Inc. | Phone numbers, calls and texts | Communications, Lead generation | Phone numbers; call audio; message content | to confirm: confirm |
| OpenAI, L.L.C. to confirm: contracting OpenAI entity | AI voice for calls and AI text responses | Communications (and any Service on Zoey-billed OpenAI inference) | Call audio and transcripts; message content; business setup details | to confirm: confirm |
| Composio to confirm: legal entity name | Connects to the client's Google Calendar to book appointments | Communications, Lead generation | Calendar event details; attendee names and emails; OAuth tokens | to confirm: confirm |
| Resend, Inc. | Sending email (sign-in, notifications, approvals, form confirmations) | All; website forms | Email addresses; email content | to confirm: confirm |
| Google LLC | Sign-in with Google for team members; Google Calendar and Meet for booked sales calls; Gmail threads logged to our CRM | Apps sign-in; our own sales | Sign-in identity; meeting details; email threads with leads | to confirm: confirm |
| Microsoft Corporation | Sign-in with Microsoft for team members | Apps sign-in | Sign-in identity | to confirm: confirm |
| PostHog, Inc. | Website analytics | Website | Page and click events, device data, under the cookie banner | United States (PostHog US Cloud) |
B. Self-hosted software (not subprocessors)
These are open-source tools we run on our own servers at DigitalOcean. The data stays on those servers; no third party operates them for us. Listed for transparency.
| Software | Use |
|---|---|
| Twenty | Our sales CRM (leads from the website) |
| Postiz | Scheduling and posting social content |
| OpenReply | Instagram comment-to-DM |
| n8n | Internal automations |
| Temporal | Background jobs for social posting |
| PostgreSQL, Redis | Databases for the above |
C. Platforms you connect (not subprocessors)
When you connect your own accounts, the platform's own terms govern what it does with data: Instagram and Facebook (Meta), TikTok, Google Business Profile and Google Calendar (your account), PropertyWare and other property-management software, Amazon and other marketplaces, and your phone carrier if you keep your own.
Change history
| Date | Change |
|---|---|
| November 3, 2026 | First business list published |
Questions: legal@zoeyos.com