Sub-processors
Every outside service that personal data handled by Dialora AI can reach, what it does, what it sees, and where it is.
Last updated: 13 November 2026
Last reviewed by: not yet reviewed by counsel
How to read this list
A business that uses Dialora AI (a "workspace") decides what happens to its customers' data, and we process that data for it. The list is in three parts, because who holds the contract with each provider differs:
- Our sub-processors. We hold the account and the key, and the workspace's data reaches them through us.
- Services the workspace connects itself. The workspace opens its own account with the provider and gives us its key. We send data there only because the workspace set it up, and the workspace's own agreement with the provider applies.
- Services for account holders. Used for the accounts of people who sign up with us, where we decide how the data is used.
Locations are where we could confirm them from the address the software calls. Where we could not confirm where a provider stores data, the table says so.
1. Our sub-processors
| Service | What it does | Personal data | Location | When it is used |
|---|---|---|---|---|
| Data-centre provider, Ahmedabad (network AS149588) | Houses the two servers we rent and run ourselves. The application server runs the service and holds the database, SIP call recordings, uploaded files and the nightly backups. The GPU server runs the private language model, our own speech-to-text, the knowledge-search index, and keeps the off-server copy of the backups. | Everything a workspace holds with us: contacts, call records, recordings, transcripts, chats, appointments, consent and do-not-call records, and account data. | Ahmedabad, IndiaBoth servers are on the provider's network AS149588, registered in India. We administer the servers; the provider has physical access to the hardware. | Always. |
| Sarvam AI | Speech to text and text to speech for Indian languages: on live calls when a workspace or agent chooses the India voice engine, and for the chat widget's microphone, WhatsApp voice notes and post-call transcription in Indian languages. | Call and voice-note audio, the text it produces, and the text of the agent's spoken replies. | IndiaSarvam's trust centre states that data stays in India; we have not verified that independently. The code calls api.sarvam.ai with the platform's own key. | Only once we have configured a Sarvam key for the platform. Without it, Indian-language transcription runs on our own GPU server and live calls use the workspace's own speech providers. |
Pending legal review. The data-centre provider's legal name, and the terms we hold with it and with Sarvam AI, are to be confirmed and published here. Neither agreement has yet been checked against the processor terms in our Data Processing Agreement.
2. Services the workspace connects itself
None of these runs until the workspace connects its own account. A workspace that uses none of them, sets its AI to private and uses the India voice engine keeps conversations on our servers in India and with Sarvam AI.
| Service | What it does | Personal data | Location | When it is used |
|---|---|---|---|---|
| Twilio | Places and receives phone calls on the workspace's Twilio numbers. Recordings of Twilio calls are kept by Twilio in the workspace's own Twilio account. | Phone numbers, call audio, recordings, call times and outcomes. | United StatesThe code calls api.twilio.com, Twilio's US region. | When the workspace enters its Twilio account details. |
| Deepgram | Turns the caller's speech into text during a live call. | Live call audio and the text it produces. | United StatesThe Deepgram SDK's default endpoint, api.deepgram.com. No other region is configured. | On live calls using the standard voice engine, with the workspace's own Deepgram key. |
| ElevenLabs | Turns the agent's reply into speech during a live call. | The text of the agent's replies, which can include details the caller gave. | United StatesThe code calls api.elevenlabs.io. No data-residency endpoint is configured. | On live calls using the standard voice engine, with the workspace's own ElevenLabs key. |
| OpenRouter, OpenAI, Anthropic | Language models that write the agent's replies, summaries and call analysis. | The conversation so far, the agent's instructions and knowledge, and the fields the agent is asked to extract. | United States; OpenRouter passes requests on to the model provider the workspace picks, which may be elsewhereThe code calls openrouter.ai, api.openai.com and api.anthropic.com. | Only when the workspace chooses one as its AI engine and enters its key. A workspace set to private sends no conversation to any of them; without a key, replies come from our own GPU server. |
| Meta (WhatsApp Cloud API) | Delivers and receives WhatsApp messages, and holds the photos, documents and voice notes people send. | Phone numbers, profile names, message text and media. | Set by Meta; not configured by this softwareThe code calls graph.facebook.com and fetches media from Meta's servers. | When the workspace connects its WhatsApp Business account. |
| Google (Calendar, Sheets) | Books appointments in the workspace's calendar and imports leads from its sheets. | Appointment details, contact details in imported sheets. | Set by Google under the workspace's own accountThe code calls www.googleapis.com with the workspace's own sign-in. | When the workspace connects Calendar or Sheets. |
| HubSpot, Slack | Receive lead details and alerts in the workspace's own HubSpot or Slack. | Lead name, phone, email, call outcome and summary. | Set by the provider under the workspace's own accountThe code calls api.hubapi.com and slack.com with the workspace's own sign-in. | Only when the workspace connects them. |
| Brevo | Sends the workspace's email notifications. | Recipient email address and the notification's content. | Set by Brevo under the workspace's own accountSent with the workspace's own Brevo key. | When the workspace switches on email notifications. |
| The workspace's own systems | A SIP carrier of its choice, webhooks, n8n, a CRM sync, an AgentLabs instance, a CloudShip account or MCP servers the workspace adds. | Whatever the workspace sends there: typically lead, call and conversation details. | Wherever the workspace runs themThe workspace enters the address or connects the account itself. | Only when the workspace sets them up. |
Pending legal review. Whether a provider the workspace contracts with directly, and reaches with its own key, counts as our sub-processor or as the workspace's own processor under the GDPR, the UK GDPR and the other laws on our regional notices page, is not settled. The list shows them either way, so a workspace can see every place its data goes.
3. Services for account holders
| Service | What it does | Personal data | Location | When it is used |
|---|---|---|---|---|
| Razorpay, Stripe, PayPal, Dodo Payments (whichever is switched on) | Take payment for plans. Card and bank details are entered on the gateway's own checkout and do not reach our servers. | Name, email, the plan, the amount, and the gateway's own payment record. | Set by each gatewayPlatform-level gateway keys in the admin settings. | When an account holder buys a plan. |
| Google sign-in | Lets an account holder sign in with a Google account. | Name and email address from Google. | Set by GoogleThe platform's own Google sign-in client. | Only if you choose to sign in with Google. |
| Outgoing email service | Sends password reset links. | Your email address and the link. | Depends on the email service the platform owner sets; none is named here yetAny SMTP service the platform owner enters in the admin settings. | When you ask for a password reset link. |
4. Changes to this list
When we add or replace one of our own sub-processors, we change this page and its date. The Data Processing Agreement sets out how a workspace hears about a change and can object to it.
There is no email alert for changes yet. To be told about changes, write to privacy@aicall.vitrano.in.