Legal
Subprocessors
Last updated: November 8, 2026.
Ask Lou LLC ("Closefinch", "we") uses these companies to provide the service. Each one processes Customer Personal Data only as the service needs. Each is bound by written terms that protect the data at least as well as our Data Processing Agreement. Each is covered by Standard Contractual Clauses (or the EU-US Data Privacy Framework) wherever data leaves the EU or UK.
We give at least 30 days' notice before adding or replacing a subprocessor: by email to each customer's owners, and on this page. A customer may object for reasonable data-protection reasons, as the DPA sets out.
Last updated: November 8, 2026
| Subprocessor | What it does for us | Data it processes | Location | When it's used |
|---|---|---|---|---|
| Hetzner Online GmbH | Hosting: servers, database, backups | All Customer Data (encrypted at rest: the database disk with LUKS2, backups with OpenPGP; connected-account tokens additionally encrypted by us) | Germany | Always |
| Cloudflare, Inc. | Network edge for the API: TLS, DDoS protection, web application firewall | Traffic to the API in transit, including the calls the web app forwards | Global edge network | Always |
| Vercel Inc. | Hosting the web app and the marketing site | Traffic to the site and the app in transit (page requests, and the API calls the app forwards); no database access | Global edge network; the app's functions run in Germany | Always |
| Anthropic, PBC | AI models (Claude) for summaries, drafting, field filling, agents and answers; and our own operator support tooling: reading redacted feedback and error reports to diagnose and fix problems [COUNSEL REVIEW: added for the ops inbox, OPS-AUTOFIX] | The text the task needs (for example an email thread, a transcript, record fields). For support tooling: the feedback text and error reports, with email addresses, phone numbers, card numbers and secrets masked first; the reporter is never named | United States | When an AI feature runs. Not used for model training (commercial terms) and kept only as Anthropic's API terms allow. An organization can bring its own Anthropic key, in which case its own agreement with Anthropic applies. Support tooling: when one of our operators diagnoses a reported problem |
| Voyage AI, Inc. | Text embeddings for semantic search | Knowledge base and document text | United States | Only when semantic search is on (Settings → AI; owners can turn it off, which deletes stored vectors) |
| Recall.ai, Inc. | Meeting recorder bot | Meeting audio, video and participant names during the meeting; media kept 7 days (30 for meetings with clips) | United States (EU region for EU deployments) | Only when an organization turns on the recorder and a person has consented to its use |
| AssemblyAI, Inc. | Transcription of uploaded recordings and in-person audio | Audio; transcripts deleted at AssemblyAI once we've copied them | United States (EU endpoint for EU deployments) | Only when a recording is uploaded or captured in person |
| Daytona Platforms, Inc. | Sandbox for agent code steps | The inputs an organization's own published code step receives | United States / EU | Only when an organization publishes an agent with a code step |
| Resend (Plus Five Five, Inc.) | Sending service email (sign-in links, invitations, digests, alerts) | Recipient address, message content | United States | Always |
| Postmark (ActiveCampaign, LLC) | Receiving email sent to agent inboxes | Inbound messages to an agent's address | United States | Only when an organization uses an agent inbox |
| ElevenLabs, Inc. | Text-to-speech for an AI phone agent's voice and persona previews | The text the agent speaks | United States | Only when an organization off the trial picks an ElevenLabs voice without bringing its own key |
| Cartesia, Inc. | Text-to-speech (an alternative) | The text the agent speaks | United States | As for ElevenLabs, with a Cartesia voice |
| Paddle.com Market Limited | Merchant of record: checkout, invoicing, sales tax and VAT | Billing contact, payment details (held by Paddle, never by us), plan and usage totals | United Kingdom / EU | When an organization buys a paid plan |
Providers you connect with your own account
These run only when an organization connects its own account, with its own key. They process what the organization sends them on its instructions, under its own agreement with the provider. They're listed so you know where that data goes.
| Provider | What it does | Data it receives | When it's used |
|---|---|---|---|
| ElevenLabs, Inc. | Text-to-speech and voice cloning | The text to speak; for a clone, the teammate's own consent recording | Voice clones, AI voice notes in a teammate's own voice, and hold and voicemail clips: only with the organization's own ElevenLabs key |
| Cartesia, Inc. | Text-to-speech and voice cloning (an alternative) | As for ElevenLabs | As for ElevenLabs, with the organization's own Cartesia key |
| HeyGen (HeyGen Technology Inc.) | AI video of a teammate from their own photo | The teammate's own photo; the audio in their own cloned voice, which HeyGen fetches and keeps (the script may name a prospect's first name and company, and any other words the teammate writes); HeyGen keeps the audio and the rendered video until they're deleted, which happens when consent is withdrawn | Only with the organization's own HeyGen account, after the teammate's written consent |
| Tavus, Inc. | AI video from a replica trained on a teammate's own video | The training video and the script (which may name a prospect's first name and company, and any other words the teammate writes); Tavus keeps the replica and videos until they're deleted, which happens when consent is withdrawn | Only with the organization's own Tavus account, after the teammate's written consent |
| ScreenshotOne | Screenshots of public web pages | The page address | Only with the organization's own ScreenshotOne account |
| AgentMail, Inc. | Agent mailboxes: sending and receiving email for an organization's AI agents at their own addresses | Agent mailbox messages (recipient and sender addresses, message content), bounce and complaint reports | Only with the organization's own AgentMail account (off by default; United States, or the EU region when the organization chooses it). Sign-in, invitation and notification email never goes through it |
| Telnyx, Inc. | Calls and texts, and browser audio for the dialer | Call audio, phone numbers, message text | Only with the organization's own Telnyx account |
The platform's own ElevenLabs or Cartesia key is used only for an AI phone agent's voice and persona previews, and only when the organization hasn't brought its own. That case is listed in the table above.
Services that act on a customer's own instructions with the customer's own accounts aren't our subprocessors. The customer's agreements with those providers apply, for example Google Workspace, Microsoft 365, Slack, Zoom, HubSpot or Salesforce when the customer connects them.