Sub-processors
Effective date: September 2, 2026
Lead Friendly engages the third-party service providers below (“sub-processors”) to operate the platform. Each sub-processor is bound by a written agreement with confidentiality, security, and (where applicable) data-processing terms consistent with our obligations to you.
Current sub-processors
| Sub-processor | Purpose | Data | Hosting region |
|---|---|---|---|
| Supabase | Database, authentication, file storage | Account data, customer content, call recordings, transcripts | United States |
| Vercel | Application hosting, edge functions, CDN | Application requests, IP addresses, performance telemetry | United States |
| Stripe | Payments, billing, subscription management, tax | Billing details, payment methods, transaction history | United States |
| PayPal | Agency commission payouts | Payee identifiers (email/account), payout amounts | United States |
| Telnyx | SIP trunking, PSTN connectivity, phone-number provisioning | Call metadata, audio streams, phone numbers, attestation data | United States |
| LiveKit | Real-time media (WebRTC) and call recording egress | Audio streams, room metadata | United States |
| Railway | Hosting for the AI voice agent worker (call audio processing and AI response generation) | Call audio streams, transcripts, prompt text, agent responses | United States |
| Deepgram | Speech-to-text (transcription) | Call audio, transcripts | United States |
| ElevenLabs | Text-to-speech (AI voice synthesis) | Generated audio, prompt text | United States |
| Anthropic | Large language model (Claude) for agent reasoning and summarization | Prompts, transcript snippets, generated responses | United States |
| Resend | Transactional email delivery | Recipient email, message content | United States |
| Cal.com | Calendar booking integration | Appointment metadata, attendee names and emails | United States / European Union |
| Persona | Identity verification (KYC) — government-ID and selfie checks for account onboarding | Government-ID images, selfie image, name, address, date of birth, verification result | United States |
| Cartesia | Text-to-speech (AI voice synthesis) — primary voice provider | Generated audio, prompt text | United States |
| Hiya | Outbound caller-ID reputation registration (branded/verified calling) | Business name, registered phone numbers, registration metadata | United States |
| PostHog | Product analytics — funnel events, user identification, attribution | User id, organization id, email, page-view + event metadata, UTM parameters | United States |
| Cloudflare | Bot-protection (Turnstile) on signup and other public forms | IP address, browser fingerprint, challenge result | United States / Global edge |
| Amazon Web Services (S3) | Long-term backup of call recordings (90-day Object Lock + Glacier IR transition at 30 days) | Call recording audio files, recording metadata | United States (us-west-2) |
| Amazon Web Services (Bedrock, Transcribe) | AI voice-agent failover — large-language-model inference (Bedrock) and speech-to-text (Transcribe) when the primary providers are unavailable | Prompt text, transcript snippets, call audio streams | United States (us-west-2) |
| Google (Gemini) | AI image generation for vehicle-photo enhancement and scene backdrops (dealership listings) | Vehicle photos, prompt text, generated images | United States |
| Opik (Comet) | LLM observability — per-call tracing of the AI voice agent | Prompt text, transcript snippets, model input/output metadata | United States |
| Sentry | Application error monitoring and crash reporting | Error events, stack traces, request metadata, IP addresses | United States |
| Upstash | Serverless Redis for API rate limiting and abuse protection | Hashed request identifiers / IP addresses, request counters | United States / Global edge |
| Hunter.io | Business-contact discovery and email enrichment for outbound prospecting | Business names, public professional email addresses, company domains | United States |
| Reoon / ZeroBounce | Email-address verification (deliverability checks) for outbound email | Recipient email addresses, verification results | United States |
| VinAudit | Vehicle history and market data (VIN decode / valuation) for dealership inventory | Vehicle identification numbers (VINs), vehicle attributes | United States |
International data transfers
Most of our sub-processors are located in the United States. Where customer data originates outside the United States, transfers are made subject to appropriate safeguards, including the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, and equivalent mechanisms in other jurisdictions.
Notice of new sub-processors
We will provide reasonable advance notice (typically 30 days) of any new or replacement sub-processor by updating this page and, for Customers under a Data Processing Agreement, by email to the contact you provide. Customers may object to a new sub-processor in good faith, in which case we will work with you to address the concern.
Questions
To request a copy of our standard Data Processing Agreement, or for any other questions about our sub-processors, email hello@leadfriendly.com.