| Sub-processor | What it processes | Location | Safeguards |
|---|---|---|---|
| Google LLC (Vertex AI) | AI content generation and live call transcription — User-generated DM/comment text (AI replies); content prompts; live audio of AI Receptionist calls, streamed for real-time transcription, and the written transcript it produces. SmashOne does not store call audio. | United States (global processing) | Google Cloud DPA and contractual confidentiality commitments |
| Google LLC (Google Workspace / Gmail) | Transactional and support email — Email address, name, message content for account and support correspondence | United States (global infrastructure) | Google Workspace DPA and contractual confidentiality commitments |
| Telegram FZ-LLC | Messaging channel: customer DMs, AI replies and support conversations — Customer messages and attachments, Telegram user id and username, timestamps | United Arab Emirates, with global message infrastructure | Processing limited to the messages customers choose to send us |
| Twilio Inc. | Telephony for AI Receptionist calls: inbound call handling and live audio transport — Caller phone number, call identifiers, call timing and duration, and the live call audio carried between the caller and our speech provider. SmashOne does not store call audio. | United States | Twilio Data Protection Addendum and contractual confidentiality commitments |
| Stripe Inc. | Payments — Payment instrument, billing address, transaction history | United States | Stripe DPA and contractual confidentiality commitments |
| Sentry | Error tracking and monitoring — Error stack traces (PII redacted) | United States | Data Safeguarding Addendum and contractual confidentiality commitments |
| Uptime Robot Service Provider Ltd. | External uptime and availability monitoring — Public endpoint URLs and availability telemetry only — no customer personal information | Malta | UptimeRobot terms and service-provider contractual terms (no sale/share under CCPA) |
| PostHog Inc. | Product analytics (server-side event tracking) — Pseudonymous usage events, feature interactions, distinct account/user identifiers | US Cloud (us.i.posthog.com) | PostHog DPA + service-provider contractual terms (no sale/share under CCPA) |
| DigitalOcean LLC | Cloud infrastructure — All hosted application data (US production) | United States | Standard Data Safeguarding Addendum and contractual confidentiality commitments |
| Backblaze, Inc. | Encrypted off-site database backups — Full production database dumps — all hosted application data, encrypted at rest | United States | Backblaze B2 terms and service-provider contractual terms (no sale/share under CCPA) |
| Cloudflare Inc. | CDN, WAF, DNS — IP addresses, request metadata, TLS termination | Global provider network | Cloudflare DPA and contractual confidentiality commitments |
| ScrapingBee SAS | Website content retrieval and search results for business profile setup and market data (server-side fetching; no customer personal data is sent) — URLs of the business's own public website and public search queries | France (EU) | DPA/EU-based processor |
01Changes to this list
We update this register before engaging a new sub-processor that will process personal information. Material changes are reflected on this page with an updated register date. Questions about a listed provider: info@smashone.us.
Privacy inquiries: info@smashone.us. SMASHONE CORPORATION, Florida, United States (Document number P26000023598).
