Sub-processors
Effective date: May 26, 2026
Lead Friendly engages the third-party service providers below (“sub-processors”) to operate the platform. Each sub-processor is bound by a written agreement with confidentiality, security, and (where applicable) data-processing terms consistent with our obligations to you.
Current sub-processors
| Sub-processor | Purpose | Data | Hosting region |
|---|---|---|---|
| Supabase | Database, authentication, file storage | Account data, customer content, call recordings, transcripts | United States |
| Vercel | Application hosting, edge functions, CDN | Application requests, IP addresses, performance telemetry | United States |
| Stripe | Payments, billing, subscription management, tax | Billing details, payment methods, transaction history | United States |
| PayPal | Agency commission payouts | Payee identifiers (email/account), payout amounts | United States |
| Telnyx | SIP trunking, PSTN connectivity, phone-number provisioning | Call metadata, audio streams, phone numbers, attestation data | United States |
| LiveKit | Real-time media (WebRTC) and call recording egress | Audio streams, room metadata | United States |
| Railway | Hosting for the AI voice agent worker (call audio processing and AI response generation) | Call audio streams, transcripts, prompt text, agent responses | United States |
| Deepgram | Speech-to-text (transcription) | Call audio, transcripts | United States |
| ElevenLabs | Text-to-speech (AI voice synthesis) | Generated audio, prompt text | United States |
| Anthropic | Large language model (Claude) for agent reasoning and summarization | Prompts, transcript snippets, generated responses | United States |
| Resend | Transactional email delivery | Recipient email, message content | United States |
| Cal.com | Calendar booking integration | Appointment metadata, attendee names and emails | United States / European Union |
| Persona | Identity verification (KYC) — government-ID and selfie checks for account onboarding | Government-ID images, selfie image, name, address, date of birth, verification result | United States |
| Cartesia | Text-to-speech (AI voice synthesis) — primary voice provider | Generated audio, prompt text | United States |
| Hiya | Outbound caller-ID reputation registration (branded/verified calling) | Business name, registered phone numbers, registration metadata | United States |
| PostHog | Product analytics — funnel events, user identification, attribution | User id, organization id, email, page-view + event metadata, UTM parameters | United States |
| Cloudflare | Bot-protection (Turnstile) on signup and other public forms | IP address, browser fingerprint, challenge result | United States / Global edge |
| Amazon Web Services (S3) | Long-term backup of call recordings (90-day Object Lock + Glacier IR transition at 30 days) | Call recording audio files, recording metadata | United States (us-west-2) |
International data transfers
Most of our sub-processors are located in the United States. Where customer data originates outside the United States, transfers are made subject to appropriate safeguards, including the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, and equivalent mechanisms in other jurisdictions.
Notice of new sub-processors
We will provide reasonable advance notice (typically 30 days) of any new or replacement sub-processor by updating this page and, for Customers under a Data Processing Agreement, by email to the contact you provide. Customers may object to a new sub-processor in good faith, in which case we will work with you to address the concern.
Questions
To request a copy of our standard Data Processing Agreement, or for any other questions about our sub-processors, email hello@leadfriendly.com.