Subprocessors
In short
These companies process personal information for us to run RelayReply. Each gets only what its job needs, and none may sell it or use it for its own advertising. Several of them handle call content: OpenAI (the AI voice and the text of calls), Twilio (the phone line), Fly.io (our call server, which the call passes through), Supabase (where saved content is stored, transcripts encrypted) and Resend (voicemail emails, if you turn them on). The table below says what each one handles.
What each provider handles
"Yes" means the provider handles that kind of data for us; "passes through" means it carries it without keeping it.
| Provider | Live call audio | Call text (captions, missions, cards, outcomes) | Saved transcripts (encrypted) | Voicemail audio | Texts and emails | Account and usage details |
|---|---|---|---|---|---|---|
| OpenAI | Yes | Yes | Readable text, only when you ask about a past call | Yes (to transcribe it) | No | No |
| Twilio | Yes (the line) | No | No | Yes, until we copy it | Texts to your number; sign-up codes | Phone numbers, call times and lengths |
| Fly.io | Passes through | Passes through (in memory) | Passes through | Passes through | Passes through | Server logs without call words |
| Supabase | No | Yes (stored) | Yes (stored encrypted) | Yes (stored privately) | Texts to your number (stored) | Yes |
| Resend | No | Voicemail transcripts in voicemail emails, if on | No | No | Emails we send you | Your email address |
| Cloudflare | No | No | No | No | Emails to our addresses (forwarded, not stored) | Website requests (IP, browser) |
| No | No | No | No | Emails to our support mailbox | Your Google sign-in name and email, if you use it | |
| Stripe | No | No | No | No | Receipts and billing emails | Billing details, plan and usage |
| PostHog | No | No | No | No | No | Screens and buttons, only if you turn analytics on |
The list
| Provider | Role | What it does for us | Where | Its own retention (as we understand it) |
|---|---|---|---|---|
| OpenAI, L.L.C. | Service provider | The AI voice on calls (GPT-Live); decisions and question cards; mission planning; outcome summaries; answers about past calls; voicemail and caller-voice transcription; checks of About me facts and announcement wording; the voicemail greeting's speech | US | API data not used for training. Abuse-monitoring logs kept up to 30 days, unless the law requires longer (OpenAI lists none for audio transcription). We send store: false. |
| Twilio Inc. | Service provider; also a carrier with its own legal duties | Phone calls (the line and the live audio stream); your RelayReply number; voicemail recording (copied to us, then deleted from Twilio); texts to your number; phone check codes (Verify); number type lookups (Lookup) | US | Call and message logs kept per Twilio's policy. Media Streams audio isn't stored by Twilio. Recordings deleted once copied. |
| Stripe, Inc. | Service provider; independent for its own fraud and financial-law duties | Payments, subscriptions, invoices, the billing page, sales tax (Stripe Tax) | US | Per Stripe's policy and financial record laws. |
| Supabase, Inc. | Service provider | Our database, sign-in (email codes and Google), and private file storage (voicemail recordings) | US | We control deletion. Backups overwritten within 7 days. |
| Fly.io, Inc. | Service provider | Our call server | US (Ashburn, Virginia: iad) | Server logs kept 7 days (Fly's log search). |
| Cloudflare, Inc. | Service provider | Hosting and delivering our website and web app; forwarding email sent to our @relayreply.com addresses to our mailbox (Email Routing); storing the record of each deletion you ask for (R2: an account id, what was deleted and when; no content) | Global network; R2 bucket in eastern North America | Website logs per Cloudflare's policy. Email Routing doesn't store email content. Deletion records as long as backups could hold the deleted data (1 year). |
| Plus Five Five, Inc. (Resend) | Service provider | Voicemail emails (with the transcript, if on), texts-deletion notices, billing and service emails, product news (if chosen), alerts to our team; sign-in code emails | US | Keeps sent emails per Resend's policy. |
| Google LLC | Independent for "Sign in with Google"; service provider for our mailbox | "Sign in with Google", only if you choose it; our support mailbox (Gmail), where email to our addresses arrives | US | Per Google's policy. |
| PostHog, Inc. | Service provider | Usage analytics, only if you turn them on: which screens you open and buttons you press, with a random id; no names, numbers, call text or contacts; IP addresses discarded; no session recording or autocapture | US (Virginia) | Per PostHog's policy. |
Not used for customer data
- AssemblyAI is wired into our code as an optional second transcriber for testing. It is off, and not used on customer calls. If we ever turn it on for customers, we'll add it here first.
- No advertising providers.
Changes to this list
We update this page before a new provider starts handling your information. If the new provider will handle call content, we also email account holders at least 30 days before it starts.