Sub-processors
Third parties that may process personal data on behalf of Ivy Digital when you use our products and services.
1. How to read this list
Ivy Digital uses the sub-processors below to operate its website, products and services. Primary customer data storage and backups are located in Mumbai, India. Some providers process data in other countries as indicated; transfers are protected as described in the DPA and Security & Data Residency.
This page is a transparency summary. The authoritative, contractual list — including change notification and objection rights — is maintained as Annex A of the Data Processing Agreement and prevails in the event of any inconsistency. We update this page when the list changes and record the review date above.
Customers may also connect third-party services themselves (for example HubSpot, Zoho, Salesforce, Google Workspace, Slack or Microsoft Teams). Those are configured and controlled by the customer and are not Ivy Digital sub-processors.
2. Infrastructure and storage
| Provider / service | Purpose | Processing location |
|---|---|---|
| Ivy-managed cloud infrastructure | Production hosting, database, object storage, backups | Mumbai, India (primary and backups) |
| Cloudflare | DNS, CDN, WAF and security | Global edge network |
3. AI model providers
AI features send the relevant content to a model provider for inference. The provider used depends on the product and the configuration selected by the customer, and customers can supply their own OpenAI-compatible endpoint where supported.
Some providers are optional. Providers marked “optional” are enabled per deployment or per customer; where a provider is not enabled, no customer data is sent to it.
Storage and inference are different. Customer data at rest stays in Mumbai, India. Inference may be performed by a third-party model provider outside India; we use API access configured for no-training and, where offered, zero data retention. Content is sent for processing only and is not used by Ivy Digital to train shared or public models.
| Provider | Used for | Typically used by | Configuration |
|---|---|---|---|
| OpenAI | Text, image, extraction and voice-adjacent generation | Most AI products, unless a BYO endpoint is configured | API mode; no-training and zero-retention settings where offered |
| Anthropic | Long-form reasoning, rewriting and generation | Launchpad, Lumen | Commercial API terms; no-training settings where offered |
| Google (Gemini) | Generation and analysis | Selected AI products | API mode |
| MiniMax | Bulk generation and low-latency scoring | Selected AI products; optional in VoxAI | Per product configuration |
| Xiaomi MiMo | Generation | Selected AI products | Per product configuration |
| DeepSeek | Document analysis | QAForge | Per product configuration |
| Sarvam AI | Indian-language chat and call analysis | VoxAI (optional) | India-based API; enabled per deployment |
| Customer-supplied endpoint | Bring-your-own model | IVY OS, Lumen, Reach, QAForge | Controlled by the customer; outside this list |
4. Payments and billing
| Provider | Purpose | Processing location |
|---|---|---|
| Stripe | Card payments and subscription billing | United States / global |
| Nomod | Payments in the UAE | United Arab Emirates |
| Razorpay | Payments where offered | India |
5. Voice, communications and delivery
Voice calls and the “Talk with Ivy” website assistant are handled by a voice platform, which may use separate telephony and voice-synthesis providers. Call audio, transcripts and related metadata are processed to provide and support the service.
| Provider | Purpose | Processing location |
|---|---|---|
| Vapi | AI voice agent platform: call handling, assistants, transcripts and recordings | United States / global |
| Twilio | Telephony and phone numbers, where configured | United States / global |
| ElevenLabs | Voice synthesis, where configured | United States |
| Resend and SMTP providers | Transactional email delivery | United States / provider locations |
6. Analytics, support and operations
| Provider | Purpose | Processing location |
|---|---|---|
| Google Analytics / Tag Manager | Website analytics and tag management | United States / global |
| Support and email tooling | Responding to enquiries and support requests | Provider locations |
| Error monitoring and logging | Security and reliability monitoring | Provider locations |
7. Changes, notice and objections
We review this list at least quarterly and update it when sub-processors are added, replaced or removed. Where a change affects personal data, we will give business customers reasonable advance notice — normally at least 30 days where required — and an opportunity to object on reasonable data-protection grounds.
If you object and the parties cannot resolve it, you may terminate the affected service as described in the DPA. To receive sub-processor change notifications, email [email protected] with the subject “Sub-processor notifications”.
8. Contact
Questions about sub-processors: [email protected] · [email protected].