Legal · Providers
Service Providers and Sub-processors
Last updated: 15 October 2026
This list covers providers used for customer service and TradieDial's own operations. A listed optional provider receives no Customer Personal Data merely because it appears here. The role depends on the feature and data: the list is not a claim that every provider is a sub-processor for every customer.
Swipe the table sideways to see each provider's purpose and data.
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase | Database, authentication support, audit records and private file storage | Customer, caller, job, account and security data |
| Vercel | Hosting, server functions, security, aggregate public-page analytics and performance telemetry | Hosted content, request/security logs and aggregate public-page telemetry |
| Vapi | AI call orchestration and telephony workflow | Call audio, number, instructions, transcript and tool results |
| Twilio | Telephone numbers, voice transport and SMS | Phone numbers, call/message routing and message content |
| OpenAI | Configured language-model processing for call and executive-assistant features | Prompts, transcripts or business context required for the selected feature |
| Anthropic | Configured language-model processing for outreach classification, drafting or executive-assistant features | Relevant approved prospect, message or business context |
| Deepgram | Speech-to-text when configured | Call audio and transcript output |
| Microsoft Azure | Speech recognition or voice fallback when configured | Call audio and generated speech |
| ElevenLabs | Synthetic voice when configured | Text to be spoken and voice settings |
| Cal.com | Appointment scheduling | Name, contact details, address/service note and appointment data |
| Mailforge (Salesforge OÜ) | Outreach mailbox/domain infrastructure, SMTP delivery and IMAP reply/bounce ingestion | Mailbox identity and credentials, sender/recipient addresses, message content and delivery/reply metadata |
| Bouncer | Business-email verification when explicitly configured | Email address and verification result |
| Google Maps Platform / Places | Business discovery, place details, geocoding and maps opened by a user | Public business details, address/postcode queries, and device/request information when a maps link is opened |
| OpenStreetMap Nominatim and CARTO | Address geocoding and internal map tiles when configured | Address search query, map request, IP and browser request metadata as applicable |
| Cloudflare | Bounded recurring scheduler and edge/network services | Scheduled endpoint, timing, response status and bounded operational results |
| Resend | Transactional service email when configured | Recipient, subject, message and delivery metadata |
| PayPal | Subscription checkout, billing status, refunds and payment events | Customer identity, subscription and transaction metadata |
Locations and transfers
Providers may process data in the UK, EEA, United States and other countries depending on the contracted entity, region and feature. There is no blanket promise of UK-only or EEA-only storage. Iceland is in the EEA and is recognised as adequate by the UK. Restricted transfers require an applicable adequacy decision or contractual safeguards and any necessary risk assessment. Contact us for the contracted recipient, enabled region, relevant onward providers and safeguards for your service; a general list does not itself establish those arrangements.
Separate purposes
Mailforge, Bouncer and prospect-discovery tools support TradieDial's own sales operations; that does not give them access to customer call recordings or job data. AI voice and transcription providers may be engaged through Vapi rather than contracted directly by the customer. The applicable provider chain must be covered by the relevant processing agreement.
Changes and objections
Material new sub-processors are notified under the DPA, normally at least 15 days before they begin processing Customer Personal Data. Customers may object on reasonable data-protection grounds by emailing hello@tradiedial.com.
Independent controllers
Payment providers, telecommunications carriers, regulators and some integration providers may act as independent controllers for limited data they process under their own legal duties. Their privacy notices govern that independent processing.
Planned Creem Merchant of Record
Creem (Armitage Labs OÜ) is the planned reseller and payment provider. Its checkout is not yet available for live payments on TradieDial. When used for a purchase, it handles buyer contact/billing details, business/tax information, payment credentials, transaction and subscription records, fraud checks and refunds as described in its Privacy Policy. TradieDial receives the billing metadata needed for the customer account; caller recordings and job notes are not supplied for this purpose.
This describes Creem's intended independent-controller payment role, not a new authorisation for it to process customer call data under our DPA. Existing PayPal processing remains separate. The enabled payment provider is identified before payment.