What is a Sub-processor?
When Ask Vinny engages third party service providers in our capacity as a data processor for our customers’ personal data, the General Data Protection Regulation (“GDPR”) and a number of other global privacy frameworks call these third-party service providers sub-processors. Sub-processors are service providers who have, or potentially will have, access to or process personal data that Ask Vinny processes for, and on behalf of, our customers.
This page outlines the types of service providers, sub-processors and affiliates we use, where they are located, and a description of the work they carry out. The list below covers our core platform sub-processors.
Due Diligence
Before engaging any service provider (including sub-processors), we perform due diligence, including a vendor security assessment. Our service providers are subject to contract terms designed to ensure that they process personal data only for the purposes of providing services to Ask Vinny, and in accordance with our commitments to customers and applicable data protection laws.
AI Inference Routing
AI inference is routed via in-region EU routing with zero data retention and data collection denied. Underlying model providers (OpenAI, Anthropic, Google and others) are only invoked via EU-eligible models, so they are not listed separately for inference.
Tenant and prospect personal data, messages, documents, work orders, property/tenancy records, integration credentials, application logs, and file uploads.
Cloud hosting and storage: PostgreSQL database (RDS), object storage (S3), secrets management, background job infrastructure, and SFTP file transfer.
United States (production data hosted in EU — Frankfurt, eu-central-1)
Name, email address, authentication tokens, and login metadata.
User authentication and SSO.
United States
Client-side session events, error traces, performance metrics, and anonymised usage data.
Application monitoring, real-user monitoring (RUM), and log aggregation.
European Union (EU cluster)
Voice call audio, transcripts, phone numbers, and conversational metadata.
Voice AI agents and telephony-based concierge interactions.
European Union (European Data Residency)
Property addresses and map coordinates.
Geocoding and map display only (not used for LLM inference, which is routed via OpenRouter).
United States
Job event payloads containing tenant/prospect data, sync records, messaging events, and workflow metadata.
Background job orchestration, scheduled crons, and async workflow execution.
European Union (self-hosted)
AI prompts, responses, traces, evaluation inputs/outputs, and conversation metadata.
AI observability, tracing, and quality evaluation.
Netherlands
Organisation and user context keys used for feature flag targeting.
Feature flag management and gradual rollouts.
United States
WhatsApp Business account setup data, business verification details, and channel onboarding metadata.
WhatsApp Business embedded signup and Graph API channel provisioning.
United States
Conversation text, tenant/property context, prompts, model responses, and tool-call payloads.
Unified LLM inference gateway. Routes requests to EU-eligible models only (e.g. OpenAI, Anthropic and Google models via OpenRouter). Zero data retention and data collection denial enforced at account/request level.
Legal entity: OpenRouter, Inc. (United States). Prompts and completions are processed entirely within the EU under Business/Enterprise in-region routing. Workspace guardrail allowed_data_regions: europe rejects non-EU requests.
European Union (in-region routing via eu.openrouter.ai)
Document text chunks, vector embeddings, and associated metadata.
Semantic search and retrieval for the knowledge base and document Q&A.
Ireland
Support ticket content, customer contact details, and communication history.
Customer support portal and ticket management.
United Kingdom
Organisation/user channel events and realtime notification payloads.
Realtime websocket updates in the web application.
United Kingdom (EU cluster)
Identity verification documents and results; payment card/billing details for self-serve signup.
Identity verification (AML/KYC) and subscription billing.
United States
Phone numbers, WhatsApp message content, template metadata, and channel configuration data.
WhatsApp Business API messaging (primary WhatsApp channel).
Germany
Phone numbers, SMS/WhatsApp/voice message content, email addresses, email body, call metadata, and delivery status.
SMS and voice messaging, WhatsApp (legacy path), transactional email (SendGrid), and delivery webhooks.
European Union (Irish/EU cluster)
Application request/response data, session tokens, API payloads, and uploaded files in transit/at rest on the hosting platform.
Application hosting, serverless compute, and content delivery for the Vinny web application.
European Union