Subprocessors

1. What this page is

AIOS is a service of NoManagement B.V. (KVK 80968724), Spijkerkade 31, 1021 JS Amsterdam, Netherlands. To run AIOS and to deliver it on our customers' behalf, we use a small set of vetted vendors that process personal information for us. These are our subprocessors. This page names each one, what it does, the personal data it handles, and where it operates. It supports the general authorization for subprocessors in our Data Processing Addendum and works alongside our Privacy Policy.

2. How to read this list

Some vendors run AIOS itself and handle information about our own customers, where we are the controller. Others help the AI agent work on a customer's behalf and handle that customer's lead and contact data, where we are the processor on the customer's documented instructions. We share data with each one only to provide the service, under contracts that require them to protect it and use it only for us.

3. Our subprocessors

Each vendor below is listed in the same form: the vendor, what it does for AIOS, the personal data it handles, and the region where it operates.

• Supabase: database, file storage and authentication for AIOS; account records, contact and lead data, and stored files; United States and EU.
• Vercel: website hosting and content delivery; page requests and standard technical logs; United States (global edge).
• Hostinger: server hosting for our self-hosted voice worker; call audio and conversation data in transit; EU.
• LiveKit: real-time voice runtime that carries call audio; live call audio streams; United States.
• Telnyx: telephone carrier, call signaling and phone numbers; caller and recipient phone numbers and call metadata; United States.
• Deepgram: speech-to-text during calls; call audio and the resulting transcripts; United States.
• Cartesia: text-to-speech during calls; the agent's reply text and the generated audio; United States.
• OpenAI: an AI model provider that understands the conversation and generates the agent's reply; the conversation content sent per request; United States.
• Anthropic: an AI model provider that understands the conversation and generates the agent's reply; the conversation content sent per request; United States.
• Google (Vertex AI): an AI model provider that understands the conversation and generates the agent's reply; the conversation content sent per request; United States.
• Groq: an AI model provider that understands the conversation and generates the agent's reply; the conversation content sent per request; United States.
• Inception Labs (Mercury): an AI model provider that understands the conversation and generates the agent's reply; the conversation content sent per request; United States.
• Meta Platforms: the WhatsApp, Messenger and Instagram messaging APIs that carry conversations when AIOS operates those channels on a customer's behalf; message content and the contact's phone number or handle; United States and Ireland (EU).
• Microsoft: the Outlook and Exchange mail APIs used when AIOS operates a customer's mailbox on their behalf; email content and the contacts involved; United States and EU.
• Resend: transactional email such as reports, confirmations and account messages; recipient email address and message content; United States.
• PostHog: product analytics about how AIOS is used; usage events and standard device and technical data; United States.
• Stripe: payment processing for support contracts, placements and project invoices; billing details and payment method (Stripe is certified to PCI-DSS and we do not store full card numbers); United States and Ireland (EU).

4. Billing and merchant of record

NoManagement B.V. is the merchant of record for AIOS and bills support contracts, developer placements and project work directly. Stripe is our payment processor: it receives the billing details and payment method needed to take a payment, is certified to the PCI-DSS standard, and we do not store full card numbers ourselves. Stripe Tax calculates and collects any value-added tax or sales tax that applies. Stripe is listed as a subprocessor above. Where you hold a provider account in your own name, that provider bills you directly and Stripe is not involved in it.

5. What is not on this list

Two things people expect to see here, and why they are not:

• The CRM and the channels you connect. These are your own systems. You choose the provider and you control the connection. When data flows to them, it flows to your systems on your instruction, not to a vendor we picked.
• Marketing-analytics trackers on our website. These handle website-visitor data for our own marketing, not your lead or contact data. They are described in our Cookie Policy, not here.

6. International transfers

We operate from the Netherlands and several of the vendors above are in the United States, so personal information may be transferred internationally. Where it is, we rely on an appropriate transfer mechanism, such as the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses, together with additional safeguards. Our Privacy Policy explains this in full.

7. Changes and how we tell you

We keep this list current and update the date above whenever it changes. Before a new subprocessor begins processing personal data, we give at least 14 days' notice. If you have a Data Processing Addendum with us, you may object within that window on reasonable data-protection grounds, and if we cannot resolve your objection you may stop using the affected part of the service. We bind every subprocessor to data-protection obligations no less protective than our own, and we remain responsible for what they do for us. To be notified of changes, email [email protected].