Subprocessors
Last updated: 2026-05-27
Revenue Recovery Engine uses the following third-party subprocessors to operate the Service. Each subprocessor is bound by a written agreement that limits their use of customer data to providing services to us, with confidentiality, security, and (where applicable) data-processing requirements equivalent to those in our agreement with you.
We notify customers at least 14 days before adding or replacing a subprocessor, per the Changes section of our Terms of Service.
| Subprocessor | Purpose | Data processed | HQ | Policy |
|---|---|---|---|---|
| Supabase, Inc. | Database, authentication, file storage (call recordings, lead CSVs) | All customer + lead data at rest | United States | Link |
| Vercel Inc. | Application hosting, serverless functions, CDN | All in-transit traffic; function logs | United States | Link |
| Stripe, Inc. | Subscription billing, payment processing, customer portal | Business name, contact email, payment method (Stripe holds card data; we do not) | United States | Link |
| Twilio Inc. | Phone numbers, SMS, voice routing | Inbound/outbound phone numbers, SMS message bodies, call metadata | United States | Link |
| Synthflow AI | AI voice agent, call transcription, call recording | Caller phone number, caller name, transcript, recording, call metadata | Germany | Link |
| Anthropic, PBC | Large language model for SMS drafting and conversation handling | Prompt content (business name, lead name/service/notes); responses | United States | Link |
| Resend, Inc. | Transactional email delivery (welcome, payment, auth, digests) | Recipient email, message subject and body | United States | Link |
| Functional Software, Inc. (Sentry) | Error tracking, performance monitoring | Error stack traces, request metadata, user id (no message bodies) | United States | Link |
| Google LLC | Google Calendar OAuth + event sync (optional, per-customer) | OAuth access + refresh tokens (encrypted at rest); calendar events created on customer's behalf | United States | Link |
| HubSpot, Inc. | CRM sync (optional, per-customer; only if customer connects) | API tokens (encrypted at rest); lead + appointment data synced to customer's HubSpot | United States | Link |
| Pipedrive OÜ | CRM sync (optional, per-customer; only if customer connects) | API tokens (encrypted at rest); lead + appointment data synced to customer's Pipedrive | Estonia | Link |
| n8n GmbH (self-hosted instance) | Workflow orchestration (reactivation, follow-up, post-call, daily digest) | Lead + appointment + call metadata passed between workflow steps | Germany | Link |
For questions about subprocessors or to request our standard Data Processing Agreement (DPA), email privacy@smartflow.tools.