LEGAL INFORMATION · 2026-09-08.2
Subprocessors and service providers
Version 2026-09-08.2. This schedule identifies the services used by Strath AI and the information they receive. A hosting region is not a promise that all support access or downstream processing stays in that region. Ask support@strath.io for current contractual and transfer information.
Supabase — database and authentication
Stores account identities, business settings, CRM, diary, support and service records. Our production database is hosted in Frankfurt. Supabase's current DPA identifies Supabase Pte. Ltd as the data importer and includes SCCs and the UK Addendum. The signed-in organisation documents page states that the DPA is incorporated into its terms automatically. International support and onward transfers must be considered alongside the database region.
Provider reference: https://supabase.com/legal/customer-resources/data-processing-addendum . Database backups and separately configured authentication/storage recovery are addressed in our recovery procedure.
Render — web application and background services
Hosts the application and workers in Frankfurt. Processes requests, service content in memory and operational logs needed to run the application. Its published DPA provides international-transfer terms including UK safeguards. The relevant agreement and downstream access remain part of supplier review; Frankfurt hosting alone is not an international-transfer assessment.
Provider reference: https://render.com/dpa . We keep provider credentials in backend configuration and do not intentionally log customer message bodies or secrets.
Retell AI — voice processing
Retell AI, Inc processes the audio and conversation information needed to operate the receptionist, plus call identifiers, agent settings and usage. We configure minimal stored call attributes and a 30-day retention setting. Live processing can still involve conversation content even where full recordings/transcripts are not retained. Its DPA must cover the applicable processing and UK transfer arrangements; completion of our agreement review is tracked internally before reopening checkout.
Provider references: https://click-agreements.retellai.com/ and https://www.retellai.com/legal/privacy-policy . Relevant downstream speech and model providers are covered by Retell's supplier arrangements and require review before introducing new processing purposes.
Twilio — telephone numbers, calls and SMS
Processes phone numbers, call routing and usage, SMS content/delivery information, and business-registration evidence required for number allocation. Global processing may apply. Its Data Protection Addendum describes several transfer mechanisms, including UK arrangements. Some telecom/account records have separate statutory or provider retention requirements.
Provider reference: https://www.twilio.com/en-us/legal/data-protection-addendum . Call records, recordings, messages and registration documents are distinct resources: deleting one does not establish removal of all others.
Resend — authentication and support email
Processes recipient addresses, email content and delivery/inbound events. Resend states that its DPA applies automatically to accounts, with SCCs and the UK Addendum. Stored data is in the United States even when the sending region is Ireland. Standard-plan email/log retention is 30 days and backups persist for seven days. Earlier message deletion requires provider assistance. Supplier-stated retention is distinct from our local workspace retention.
Provider reference: https://resend.com/security/gdpr . Resend's notice period for changes to its own subprocessors is 14 days; our 30-day notice commitment concerns our appointment of a new direct subprocessor.
Stripe — payments
Processes checkout, billing identity, subscription, invoice, refund and payment information. Full card details are entered with Stripe and are not stored in our application database. Stripe may act as an independent controller for some payment, fraud and regulatory processing and as a processor for other functions; it is not described as solely a subprocessor.
Provider references: https://stripe.com/gb/legal/dpa and https://stripe.com/privacy . Statutory financial retention may continue after operational account data is removed.
Optional address lookup and changes
Where enabled, Ideal Postcodes receives the address/postcode query required for lookup. It must be included in the relevant supplier review before enabling that feature for customer data. Other suppliers are not authorised merely because a library or integration is installed.
New direct subprocessors are subject to the DPA's notice and objection procedure. We assess downstream supplier changes and tell affected customers promptly. This list does not claim independent security certification or that unsigned agreements have been executed.
Questions? Contact support@strath.io.