Subprocessors

XALLER AI, a trade name of ZPEACHY LLC ("Xaller.ai") uses the following subprocessors to provide the Xaller.ai service. Each processes customer personal data to provide its service to us, under a contract with data-protection terms. Under those terms, some providers also process limited data for their own purposes, such as security, fraud and abuse prevention, service improvement, billing and legal compliance; the "Provider's own purposes" column says where this applies. This list is referenced by our Data Processing Addendum, and we update it before adding or replacing a subprocessor, as the DPA describes. Providers used only by the full service begin processing when it opens to customers; the early-access website uses AWS, Cloudflare and Proton.

How a call flows

A caller's call reaches the business's Xaller.ai number at Twilio, which carries the live audio to LiveKit. LiveKit hosts the AI agent session and streams the audio to OpenAI for speech understanding and the agent's replies. LiveKit records the mixed call audio and uploads the recording to our storage at AWS, where transcripts, summaries and caller details are also kept. After the call, the transcript is sent to OpenAI for the summary and analysis.

Infrastructure and call handling

Subprocessor	Purpose	Data processed	Retention at the provider	Provider's own purposes	Location
Amazon Web Services, Inc.	Application hosting, database, recording and file storage, secrets, monitoring, and transactional email (Amazon SES)	All customer data, including recordings, transcripts and caller details; email recipients and content	Under our control; deleted on our retention schedule, backups expire after about 30 days	Security, abuse prevention and service operations under AWS terms	United States (us-east-2); SES in us-east-2
Twilio Inc.	Phone numbers, carrying inbound call audio to our voice infrastructure, and text-message notifications to verified recipients	Live call audio in transit, caller and called numbers, call metadata, notification text	Call metadata and message logs per Twilio's standard retention; Twilio does not record calls	Fraud prevention, network security and legal compliance (including carrier and regulatory requirements)	United States
LiveKit, Inc.	Real-time voice infrastructure: connects calls to the AI agent, hosts the agent session and records the call	Live call audio, the agent's audio and messages, call metadata; the recording until it is uploaded to our AWS storage	Streams in real time; recordings are written to our AWS storage. Session metadata and logs per LiveKit's standard retention	Service operation, security and abuse prevention	LiveKit Cloud network; each call is served from a nearby region
OpenAI, L.L.C.	AI speech understanding and voice replies during the call; transcript summaries and call analysis afterwards; the in-app support assistant and knowledge-base processing	Live call audio, transcripts, the business's agent instructions and knowledge, support-assistant messages	Analysis requests are sent with storage disabled. Real-time voice and other API data may be retained up to 30 days for abuse monitoring	Abuse and misuse monitoring; OpenAI does not train on API data	United States
Cloudflare, Inc.	Website hosting and delivery, network security (firewall and secure tunnel) and public-form bot protection	Website and application traffic, IP addresses, request metadata; data in transit through the tunnel	Request logs per Cloudflare's standard retention	Network security, bot detection and improving its security services (including Turnstile signals)	Global network

Business operations

Subprocessor	Purpose	Data processed	Provider's own purposes	Location
Stripe, Inc.	Subscription billing, payments and tax calculation	Business name and account owner email, billing address, payment details (held by Stripe), invoices and usage quantities	Fraud prevention (including Radar), compliance with financial regulations; Stripe acts as an independent controller for some payment data	United States
Proton AG	Team inbox for support, sales, legal and privacy requests, and sending early-access website emails (waitlist confirmations and contact-form deliveries)	Correspondence customers and callers send us; waitlist registrants' names and email addresses	Security and abuse prevention; mailboxes are stored encrypted	Switzerland

Not subprocessors

• Tools you connect (for example Google Calendar, Microsoft Outlook, HubSpot, Slack, Jobber or Clio Grow) receive information because you direct us to send it. Your agreement with each provider governs that processing.
• Google sign-in, if you choose it, is between you and Google; we receive your Google account identifier, email and name.
• Website analytics (Plausible), when enabled on the public website, receive cookieless page-view counts only, not customer or caller data, and run on no signed-in page. The early-access website runs no analytics.