1. About this list
To deliver the Asteri platform we use a small number of third-party processors. They process personal data only for the service purposes described below. Where applicable, we use written data-processing terms or other contractual and privacy safeguards appropriate to the provider's role and the requirements of GDPR Art. 28, the UK Data Protection Act 2018, and other applicable law.
We notify customers of any material change to this list at least 30 days before the change takes effect. To subscribe to change notifications, email privacy@getasteri.com with the subject "Subscribe: Sub-Processor Updates."
Change for PostHog, Inc.: since October 28, 2026, Asteri has used PostHog to analyze its own account, billing and usage records and engineering issues. PostHog can read only the records its row in Section 2 lists, not the customer records businesses keep in Asteri. From December 1, 2026, PostHog also receives the error, screen recording, usage, AI usage and log data its row lists.
2. Current sub-processors
| Provider | Purpose | Data | Region |
|---|---|---|---|
| RevenueCat | App Store and Google Play purchase verification, restoration and subscription lifecycle processing. | Workspace billing identifier, store product and transaction identifiers, purchase evidence, purchase/expiry dates, subscription status, and related app, device and network information. | Provider-operated infrastructure under the applicable service and data-processing terms. |
| ElevenLabs | Optional AI receptionist calls, speech processing and conversation tools. | Call audio, transcripts, caller details and relevant workspace context. New receptionist agents are configured with recording enabled and a 10-day provider retention setting; organization records and legal retention may differ. | Provider infrastructure selected for the configured account and service. |
| Radar Labs, Inc. | Address lookup, geocoding and geographic search. | Submitted address or search text, coordinates needed for the request and request metadata. | Provider-operated infrastructure; subject to the applicable service terms. |
| Fly.io | Backend workers, realtime services and application infrastructure. | Application data processed by hosted services, queued work, operational logs and request metadata. | Regions selected for the deployed services, with provider-operated supporting infrastructure. |
| Z.ai | Routed language-model inference, including fallback processing for supported AI features. | Prompt, relevant workspace context, tool results, generated responses and usage metadata. | Provider infrastructure selected through the configured AI routing service. |
| Stripe, Inc. | Payment processing (cards, ACH, subscriptions). Stripe Connect for service-business payouts. | Cardholder data (tokenized — never touches our servers), billing address, email, payment metadata. | United States (with global processing edges). |
| PlanetScale, Inc. | Managed Postgres database hosting (primary application database). | All customer records, organization data, communications, files metadata. | United States (US-East). EU residency available on request for Enterprise. |
| Cloudflare, Inc. | Object storage (R2) for files, photos, attachments, exports. Edge network and DDoS protection. | Uploaded files (invoices, estimates, floor photos, avatars, signed documents). | Global edge with US storage by default. Region restrictions available. |
| 650 Industries, Inc. (Expo) | EAS mobile build, submission and update delivery; startup-performance monitoring; bounded operational events; optional push-notification routing. | Project/app/build/update identifiers, device and operating-system metadata, persistent installation/session identifiers, startup metrics, bounded event fields, and push tokens when Expo push routing is used. Asteri disables resolved-URL and route-parameter export. | United States with globally operated service infrastructure. |
| Telnyx LLC | SMS / MMS messaging and voice calling. | Customer phone numbers, message contents, call audio/recordings, voicemail, delivery and call metadata. | United States. |
| Resend, Inc. | Transactional and marketing email delivery. | Recipient email, sender identity, subject, message body, delivery metadata. | United States. |
| OpenAI, L.L.C. | AI model inference and embeddings routed through Vercel AI Gateway for supported Asteri AI features, including the optional talking to Asteri AI in the chat on the web. | Prompt, context, media, transcript, response, usage, and embedding content sent for the requested AI operation. When talking to Asteri AI: the voice of the person talking and the replies read aloud to them, which can include customer names, addresses, amounts and other workspace details, and transcripts of both, sent between the browser and OpenAI through Vercel AI Gateway. Asteri turns off the option to save a recording of the session, and stores what was said and the replies in the chat, not the audio. Zero data retention is not available for this feature, so OpenAI may keep this content under its own retention terms; OpenAI's documents list 30 days for abuse monitoring. | United States. |
| Hangzhou DeepSeek Artificial Intelligence Co., Ltd. | Routed language-model inference for supported Asteri text features. | Prompt, context, response, and usage content sent for the requested AI operation. | Provider infrastructure selected through Asteri's AI routing service. |
| Google LLC | Optional Google Sign-In, Calendar, Drive, Business Profile, and Google Ads integrations; Firebase Cloud Messaging; Maps SDK for Android; plus routed Gemini model inference for supported AI features. | User-authorized Google identity, Workspace, business-listing, advertising, and conversion data required by the selected integration; Android push-registration and delivery metadata; Maps SDK device, network, usage and crash metadata; or prompt, context, media, response, and usage content for a requested Gemini operation. OAuth tokens are stored encrypted. | United States (with global edges). |
| Sentry (Functional Software, Inc.) | Application error monitoring and performance telemetry. | Stack traces, request and device metadata, diagnostic context and breadcrumbs. Default personal-information collection is disabled where configured, and selected sensitive fields are filtered. Error content may still contain information associated with a user or workspace. | United States. |
| PostHog, Inc. | Since October 28, 2026: analysis of Asteri's own account, billing and usage records and engineering issues. From December 1, 2026, also: error and crash monitoring, masked screen recordings made only around errors, product and website usage analytics, AI usage records, and application logs. |
| United States. |
| Vercel, Inc. | Web application hosting, edge delivery, and AI Gateway routing. | Server logs and request metadata, plus prompt, context, media, response, and usage content transiting AI Gateway for a requested AI operation. | Global edge with US primary region. |
3. International transfers
Where personal data is transferred outside the EEA, UK, or Switzerland, we rely on one or more of the following safeguards: Standard Contractual Clauses (SCC 2021/914), the UK International Data Transfer Addendum, the EU-U.S. Data Privacy Framework where the sub-processor is certified, or the customer's own explicit consent for ad-hoc transfers.
4. Data Processing Agreement
Our standard Data Processing Agreement is available to all customers on request. Email privacy@getasteri.com with the subject "DPA Request" and include your organization name. We counter-sign and return within 5 business days. EEA / UK / Swiss customers receive the SCC-annexed version by default.