Sub-processors
Sub-processors.
In force from 29 October 2026 · Last updated 29 October 2026
These are the companies that process personal data for AERA, for our own business and for the clients we run agents and automations for. Each processes it under its business or service terms. This list is part of our privacy policy and our data-processing agreement.
1. Website, payments and business tools
| Provider | What it does for AERA | Personal data | Location and transfer basis |
|---|---|---|---|
| Vercel Inc. | Hosts aeraops.com, runs its server functions and scheduled jobs, stores uploaded files (Vercel Blob), bot protection on checkout | Everything sent through the site: form contents, uploads, IP address and request data | USA. EU/UK data: Standard Contractual Clauses, or the EU-US Data Privacy Framework where the provider is certified. |
| Upstash, Inc. | Database for the inquiry queue, orders, client-portal state and rate limits | Inquiry and order details; IP addresses only as salted hashes | USA. EU/UK data: Standard Contractual Clauses, or the EU-US Data Privacy Framework where the provider is certified. |
| Resend (Plus Five Five, Inc.) | Sends AERA's transactional email (inquiry confirmations, proposals, invoices, portal links) | Name, email address, message content | USA. EU/UK data: Standard Contractual Clauses, or the EU-US Data Privacy Framework where the provider is certified. |
| PayPal | Takes card and PayPal payments. PayPal is also an independent controller for the payment itself | Name, email, amount, invoice and transaction IDs. AERA never sees full card numbers | USA / Luxembourg (PayPal Europe). Transfers under PayPal's own safeguards |
| Google LLC | Gmail (AERA's mailbox), Google Drive and Sheets (inquiry and order records), Google Analytics 4 (only with your consent) | Correspondence, inquiry and order details; for analytics, pseudonymous usage data | USA. EU/UK data: Standard Contractual Clauses, or the EU-US Data Privacy Framework where the provider is certified. |
| Calendly LLC | Call booking | Name, email, chosen time, answers you give when booking | USA. EU/UK data: Standard Contractual Clauses, or the EU-US Data Privacy Framework where the provider is certified. |
2. Front desk and AI agents
| Provider | What it does for AERA | Personal data | Location and transfer basis |
|---|---|---|---|
| WhatsApp (Meta Platforms) | The messaging channel for AERA's front desk and for clients' WhatsApp agents. Meta is an independent controller for the WhatsApp service | Phone number, profile name, messages, voice notes and media | USA / Ireland (Meta). Transfers under Meta's own safeguards |
| OpenAI | AI model that drafts the front desk's replies and internal summaries, used through AERA's ChatGPT subscription and under its terms | The text of the conversation needed to write the reply | USA. EU/UK data: Standard Contractual Clauses, or the EU-US Data Privacy Framework where the provider is certified. |
| ElevenLabs | Voice: speech-to-text, text-to-speech and the AI agent platform for voice and client agents | Call audio, voice notes, transcripts (kept 90 days) | USA. EU/UK data: Standard Contractual Clauses, or the EU-US Data Privacy Framework where the provider is certified. |
For clients' agents, the client's own accounts (for example its WhatsApp Business account, Google or Microsoft account) are the client's, not AERA's sub-processors.
3. Changes
We update this page before a new provider processes personal data, and tell clients at least 30 days ahead, as the DPA requires. Questions or objections: aeraops@gmail.com.