Skip to content
WoneAssistant

Legal

Sub-processors

The third parties that process personal data for WoneAssistant, grouped by function, with providers named where we can verify them against the product.

Version:
2.0
Effective:
11 November 2026
Last updated:
11 November 2026
On this page (6 sections)
  1. 1. About this list
  2. 2. Sub-processors by category
  3. 3. Changes and notice
  4. 4. Other parties that are not our sub-processors
  5. 5. Locations and transfers
  6. 6. Questions

1. About this list

1.1

A sub-processor is a third party engaged by us that processes personal data in Customer Content on our behalf. This page lists them by category. Providers that act for their own purposes (for example a bank) and services that you choose to connect yourself are described separately in section 4. Terms such as “Customer Content” are defined in the Privacy Policy, and the commitments we make about sub-processors are in the Data Processing Addendum summary.

1.2

Which carriers and model providers handle a particular Customer depends on the countries, number types and features that Customer uses. Not every provider below handles every Customer’s data.

2. Sub-processors by category

Sub-processors, purposes and data
Category and providerPurposeData involved
Telephony carriers: Telnyx, BandwidthSupplying and porting telephone numbers, carrying inbound and outbound calls and SMS, caller identification and emergency address validation.Phone numbers, call detail records, call media in transit, SMS content, number porting and address details.
AI language models: DeepSeek, Kimi (Moonshot AI)Generating assistant replies, summaries and classifications, and computing text embeddings for knowledge search, through an OpenAI-compatible model gateway operated by us. Which model serves a request depends on configuration.Conversation text (including transcripts of what callers said), instructions, knowledge excerpts and tool results sent in a request. Audio is not sent to these providers.
Payments: StripeTaking subscription and wallet payments, preventing payment fraud and issuing receipts. Stripe acts as an independent controller for payment data it collects.Billing name, email, country, payment method details and transaction records.
Website delivery and security: CloudflareContent delivery, DNS and protection against attacks for woneassistant.com and the Service.IP address and request details for traffic that passes through it.
Hosting and speech processing: operated by WoneAssistantThe platform, databases, the website, speech recognition and speech synthesis run on infrastructure we operate.All categories of data, under the security measures in the Privacy Policy.

Notice

What is and is not on this list

We list only providers that we can verify against the product and our own records. If we engage another provider to process Customer Content, such as an email relay or a further carrier or model provider, we add it to this list and give notice as described in section 3 before it processes Customer Content.

3. Changes and notice

3.1

We update this page at least 30 days before a new or replacement sub-processor starts to process Customer Content. Customer administrators can ask, through the contact form with the legal topic, to be notified of changes directly, and may object on reasonable data protection grounds within that period as set out in the Data Processing Addendum.

3.2

Urgent replacement is possible where a sub-processor fails or poses a security risk, in which case we notify as soon as practicable.

4. Other parties that are not our sub-processors

  • Services you connect, such as a mailbox account, calendar or other tool you authorise. They act on your instructions and under your agreement with them.
  • Your own telephone carrier when you port a number in or out, and the networks that carry a call to or from a person.
  • Your callers’ own carriers and devices.
  • Professional advisers, insurers and authorities, who receive data only as described in the Privacy Policy.

5. Locations and transfers

Sub-processors and their systems may be located in, or access data from, countries other than yours, including the United States. Transfers of personal data from the EEA and the UK are covered by the mechanisms described in the Privacy Policy and the Data Processing Addendum. On request we will tell a Customer the countries involved for the features the Customer uses.

6. Questions

Use the contact form with the legal topic for sub-processor questions, or the privacy topic for personal data questions. See the Legal hub and the Trust page.

Version history

  1. Version 2.011 November 2026

    First publication as a standalone register. Replaces the sub-processor list in Privacy Policy version 1.0.