Legal

Sub-processors

Last updated 9 October 2026

To run your agents, NordTell uses other companies for parts of the work: hosting, phone calls, e-mail, payments, and the AI models that listen, think and speak. When they handle personal data for us, they are our sub-processors. This page lists every one of them. It is part of our Data Processing Agreement.

Which ones a call uses is up to you

Many of the services below are used only if you choose them. For each agent, and for each of its languages, you pick the speech recognition, the language model and the voice, and you pick the numbers your calls run on. The platform names the provider next to every choice. If a service you picked can't handle a call, for example one of its languages, the platform may switch to another service on this list so the call still works.

Where your data goes

Your data is stored in the EU: our servers in Frankfurt, Germany, and our backups in Amsterdam, the Netherlands. Some of the services below process the content of a call, its audio and its text, outside the EU, mainly in the USA. Those transfers rest on the EU-US Data Privacy Framework where the company is certified, with the EU Standard Contractual Clauses as the fallback, or on the Standard Contractual Clauses alone where it is not.

Every company that processes personal data for us. "Data Privacy Framework" is the EU-US Data Privacy Framework; "Standard Contractual Clauses" are the EU's.
Service	What it does for us	Data it gets	Where	Transfer basis	Its terms
Hosting, e-mail and payments: always used
DigitalOcean DigitalOcean, LLC, USA	Our servers, database and file storage, and our backups.	Everything stored in the platform: accounts, agents, calls, recordings, transcripts, leads and documents.	Frankfurt, Germany (servers); Amsterdam, the Netherlands (backups). Both in the EU.	Stored in the EU. DigitalOcean is a US company: Data Privacy Framework, with Standard Contractual Clauses as the fallback.	Data processing agreement
Simply.com Simply.com A/S (team.blue Denmark A/S), Denmark	Sends our e-mails, such as password resets, invitations and alerts.	E-mail addresses, and what our e-mails to you and your team say.	Denmark (EU).	None needed: stays in the EU.	Compliance and data processing
Stripe Stripe Payments Europe, Ltd., Ireland; data also goes to Stripe, LLC, USA	Takes payments, works out VAT and issues invoices.	The account owner's name, e-mail, billing address and VAT number, payment details and payment history. No call data.	EU and USA.	Data Privacy Framework (Stripe, LLC) and Standard Contractual Clauses. Stripe is also a controller in its own right for fraud prevention, anti-money-laundering checks and its own billing.	Data processing agreement
Phone calls
LiveKit LiveKit Incorporated, USA	Carries the audio of phone calls between the phone network and our servers.	Call audio while the call runs, and the phone numbers on the call.	The LiveKit servers nearest the call, which can be outside the EU. The audio passes through and is not stored there.	Data Privacy Framework, with Standard Contractual Clauses as the fallback.	Data processing addendum
Telnyx Telnyx LLC, USA	Phone numbers and calls on our own phone account, and text messages sent through it.	Phone numbers, call audio, text messages and call records.	USA.	Data Privacy Framework, with Standard Contractual Clauses as the fallback.	Data processing addendum
Twilio Twilio Ireland Limited; data goes to Twilio Inc., USA	Only if you connect Twilio numbers: routes and places the calls on them.	Phone numbers, call audio and call records.	USA.	Data Privacy Framework, Binding Corporate Rules and Standard Contractual Clauses.	Data protection addendum
AI: language models and realtime voice
OpenAI OpenAI Ireland Ltd	For every account: writes the summary of each call, makes knowledge bases searchable, and runs the AI editor and the Copilot. When you choose it: the agent's language model or realtime voice, and the AI Butler's model (its default).	Transcripts, prompts and knowledge-base text; call audio for a realtime voice.	Not limited to the EU; mainly the USA.	Standard Contractual Clauses (OpenAI is not on the Data Privacy Framework list).	Data processing addendum
Anthropic Anthropic Ireland, Limited	When you choose it: the agent's language model, or the AI Butler's.	Transcripts and prompts.	USA.	Standard Contractual Clauses (Anthropic is not on the Data Privacy Framework list).	Data processing addendum
Google (Gemini API, paid) Google Cloud EMEA Limited	When you choose it: the agent's language model or realtime voice, or the AI Butler's model.	Transcripts and prompts; call audio for a realtime voice.	Wherever Google has facilities, which can be outside the EU.	Data Privacy Framework (Google LLC), with Standard Contractual Clauses as the fallback. On the paid service Google does not use the data to improve its products.	Gemini API terms and data processing addendum
AI: speech recognition and voices
ElevenLabs Eleven Labs Inc., USA	When you choose it: the agent's voice, speech recognition (Scribe) and voice cloning.	The text your agent speaks, call audio for speech recognition, and the voice samples you upload to clone a voice.	USA.	Data Privacy Framework, with Standard Contractual Clauses as the fallback. Use of our data for model training is switched off in our account.	Data processing addendum
Cartesia Cartesia AI, Inc., USA	When you choose it: the agent's voice and voice cloning.	The text your agent speaks, and the voice samples you upload to clone a voice.	USA.	Standard Contractual Clauses in its data protection addendum, which is part of its terms (Cartesia is not on the Data Privacy Framework list). Model training is switched off in our account.	Data protection addendum
Deepgram Deepgram, Inc., USA	When you choose it: speech recognition.	Call audio.	EU: we use Deepgram's EU servers.	Processed in the EU. Deepgram is a US company and not on the Data Privacy Framework list: Standard Contractual Clauses in its data processing agreement. Our requests opt out of Deepgram's model improvement programme.	Privacy policy
Soniox Soniox Inc., USA	When you choose it: speech recognition.	Call audio.	USA.	Standard Contractual Clauses in its data processing agreement (Soniox is not on the Data Privacy Framework list).	Privacy policy
Gladia Gladia SAS, France	When you choose it: speech recognition.	Call audio.	EU.	None needed: processed in the EU.	Data processing agreement

Not our sub-processors

Services you connect yourself: your own phone provider or SIP account, webhooks, custom tools, MCP servers, your calendar booking account, and the apps your automation flows talk to. Data goes to them because you set it up, and they work for you under your own agreement with them.
The automation studio runs on our own server, not at another company. Its flows send data only where you connect them.
Signing in with Google, Microsoft, GitHub or Apple: if you choose one of them to sign in, that company handles the sign-in as a controller in its own right, under its own privacy policy: Google (Google Ireland Limited), Microsoft (Microsoft Ireland Operations Limited), GitHub and Apple (Apple Distribution International Limited).

Changes

Before a new sub-processor starts processing your data, we add it to this page and note it in the log below, with the date at the top. We don't send e-mails about it, so look here. If you object to a new sub-processor, write to us at hello@nordtell.com; the Data Processing Agreement says what happens next.

9 October 2026: list first published.