Subprocessors
Version of 26 October 2026
These are the providers INFIOO itself engages to run the service. Each is bound by a data processing agreement and processes data only for the purpose shown. Tools you connect from Settings — your accounting software, calendar, CRM, PayPal or WhatsApp Business account, and the AI assistants you link — are not subprocessors: they are your own accounts, and the connection sends them exactly what it exists to send (see the privacy notice).
Current list
| Provider | What for | Data that can reach them | Where | Safeguard | When |
|---|---|---|---|---|---|
| Google Cloud | The database that holds your workspace, the servers that run the app, and operational logs | All workspace and account data | Database: Frankfurt, Germany (europe-west3). App servers: Singapore (asia-southeast1). Logs: Google Cloud | Google Cloud Data Processing Addendum with EU Standard Contractual Clauses | Always |
| Google Firebase Authentication | Sign-in and account security | Email address, password (stored hashed), name, Google sign-in profile (name, email, photo link), sign-in IP addresses and browser details. Kept: Sign-in IP addresses for a few weeks; account data until deleted, then out of Google's backups within 180 days | United States | Google Cloud Data Processing Addendum with EU Standard Contractual Clauses | Always |
| Google Vertex AI | Fioo's main AI model (Gemini): understanding requests and drafting replies, plus the search index for your knowledge entries | What each request needs: e.g. the customer's message and recent conversation, contact name and tags, your services and knowledge entries, free time slots, photos you send Fioo. Kept: Held in memory for up to 24 hours for caching; not stored for training | Google's global endpoint (any Google region, including the United States) | Google Cloud Data Processing Addendum with EU Standard Contractual Clauses; Google may not train its models on it | When AI features are switched on |
| Anthropic | Claude models, used when the main model is unavailable or returns an unusable answer — for drafting and for the checks that run before an automatic send | The same kind of content as Google Vertex AI, for the requests it handles. Kept: Up to 30 days for abuse monitoring, then deleted | United States | EU Standard Contractual Clauses (with the UK Addendum), or the EU–U.S. Data Privacy Framework where the provider is certified; Anthropic's commercial terms bar training on API data | When AI features are switched on |
| OpenAI | GPT models, used when the other models are unavailable | The same kind of content as Google Vertex AI, without photos. Kept: Up to 30 days for abuse monitoring, then deleted | United States | EU Standard Contractual Clauses (with the UK Addendum), or the EU–U.S. Data Privacy Framework where the provider is certified; OpenAI's services agreement bars training on API data | When AI features are switched on |
| Twilio | Phone numbers, SMS and WhatsApp delivery, call forwarding, live speech-to-text on your phone line, and US SMS (A2P 10DLC) registration | Phone numbers, message contents, what callers say (transcribed live — calls are not recorded), your business details for SMS registration | United States | EU Standard Contractual Clauses (with the UK Addendum), or the EU–U.S. Data Privacy Framework where the provider is certified | When you turn on texting, WhatsApp or a phone number |
| Resend | Sending email for your business when it isn't sent from your own Gmail, receiving lead emails forwarded to your INFIOO address, and delivery notices | Email addresses, names, email contents | United States | EU Standard Contractual Clauses (with the UK Addendum), or the EU–U.S. Data Privacy Framework where the provider is certified | When email is switched on |
| Google Workspace | INFIOO's own account emails: verification, password reset, invitations | Your name, email address and the message | Google Cloud | Google Workspace Data Processing Amendment with EU Standard Contractual Clauses | For INFIOO's own account emails |
| Stripe | Your INFIOO subscription, and card payments and payouts for invoices you send through INFIOO | Billing contact and payment details (held by Stripe, never by INFIOO); for card invoices, your customer's name, email and the invoice | United States and Ireland | EU Standard Contractual Clauses (with the UK Addendum), or the EU–U.S. Data Privacy Framework where the provider is certified | When billing or card payments are switched on |
| Uberall | Updating your Google Business Profile, publishing posts and replying to reviews | Your business listing, posts, and reviews including reviewer names | Germany | EU company; any onward transfer under EU Standard Contractual Clauses | When you connect your Google Business Profile |
| Ayrshare | Publishing posts to the social media accounts you link | Post text and images, your business name, the linked social accounts | United States | EU Standard Contractual Clauses (with the UK Addendum), or the EU–U.S. Data Privacy Framework where the provider is certified | When you link social accounts |
| Entri | Setting up DNS records for your own domain (website and email sending) | Your domain and DNS records; your IP address and browser details when its setup window loads | United States | EU Standard Contractual Clauses (with the UK Addendum), or the EU–U.S. Data Privacy Framework where the provider is certified | When you open website or email-domain settings |
How we announce changes
We announce a new or replacement subprocessor at least 30 days in advance, by email to account owners and on this page. You may object as the data processing addendum sets out. Questions: hello@infioo.com.
Changes to this document
- 26 October 2026: Every connection now runs on INFIOO's own registered app with each tool, so the sign-in screen names INFIOO and no connection provider sits in between. Nango is no longer used and leaves the subprocessor list; access tokens are kept encrypted in INFIOO's own database in Frankfurt and deleted when you disconnect. Nothing changes in what each connection reads or does.
- 25 October 2026: More connections now run through Nango, our connection provider: Outlook, Google Calendar, Outlook Calendar, HubSpot, Pipedrive, Zoho CRM, Square, Mailchimp and Constant Contact join Gmail, Calendly and Acuity. Nango holds their access tokens; Google Calendar tokens move there from INFIOO's own database. Nothing changes in what each connection reads or does.
- 6 October 2026: One set of documents for the INFIOO software, replacing the older website-services terms. Adds the data processing addendum, the Google API disclosure, How Fioo uses data, acceptable use, cookies, switching and export, and the illegal-content report route; the subprocessor list now names every provider and where it processes data.