Sub-processors
Last updated
Eight vendors process data on our behalf so Loonext can run, from the SMS carrier to payments, hosting, email, and analytics. Each is limited to what its job requires, and message content stays out of our error and analytics tools. Six features send message content or voicemail audio to an AI model, and they are named in full below. Data lives in the United States, with one named exception: AI inference runs on Cloudflare’s global network and cannot be confined to a country. When this list changes, this page and the date above change with it.
Current sub-processors
| Vendor | What it does | Data it touches | Region |
|---|---|---|---|
| Telnyx | SMS/MMS carriage, phone numbers, 10DLC registration | Message content, contact phone numbers, business registration details | United States |
| Stripe | Subscription payments, tax calculation, billing portal | Billing contact, subscription and payment identifiers, tax location | United States |
| Supabase (on AWS) | Database, authentication, and file storage | All account, contact, and message data; MMS attachments | United States. AWS us-east-1 |
| Cloudflareincluding Workers AI | Application hosting, CDN, network security, and AI features | Request metadata (IP, headers); message content and voicemail audio sent to Workers AI for the features listed below | Global edge network. AI inference is not confined to any one country (see below) |
| Resend | Transactional email (notifications, billing, invites) | Recipient email address and email content | United States |
| Google (Firebase Cloud Messaging) | Push notifications to the Android and iPhone apps | Device push tokens; the notification preview, which contains the sender name and a short message excerpt | United States. Relayed on to Apple's push service for iPhones |
| Sentry | Error monitoring | Error diagnostics with PII scrubbed, no message bodies or phone numbers | United States |
| PostHog | Product analytics (events only) | Event names, counts, and UUIDs, no message content; cookieless on marketing pages | United States |
Data lives primarily in the United States (Supabase on AWS us-east-1). We keep message content out of Sentry and PostHog by design, see our security page and privacy policy.
AI features
Three features send content to an AI model. All of them run on Cloudflare Workers AI, inside the same Cloudflare account and network boundary as the rest of the application, which is why Cloudflare appears once above rather than twice. What each one sends, and the model that receives it:
| Feature | What it sends | Model | On by default |
|---|---|---|---|
| Suggested replies | the recent messages in that conversation and your business description, to draft a reply for a person to edit and send | @cf/meta/llama-3.1-8b-instruct-fast | Yes |
| Task details | the text of the message a task was made from, to fill in the task's details | @cf/meta/llama-3.2-1b-instruct | Yes |
| Voicemail transcripts | the voicemail recording, to write it down so it can be read instead of played | @cf/openai/whisper-large-v3-turbo, @cf/openai/whisper | Yes |
| Voicemail intake | the voicemail transcript, to pull out what the caller said the problem was and the address they gave | @cf/meta/llama-3.1-8b-instruct-fast | No |
| Call wrap-ups | the crew member's own dictation after a call has ended, to write it down as a note. Never the call itself and never the customer's voice | @cf/openai/whisper-large-v3-turbo, @cf/openai/whisper | Yes |
| Thread catch-ups | up to the 40 most recent messages in that conversation, to write a short catch-up for somebody on the crew who has not read it. Internal notes are never included | @cf/meta/llama-3.1-8b-instruct-fast | Yes |
Of those models, two by Meta and two by OpenAI. They run on Cloudflare’s infrastructure under Cloudflare’s terms; we do not send your data to those companies directly. We name them because who wrote the model is something you would reasonably want to know before a customer’s voicemail is transcribed by it.
Where this happens. AI inference runs on Cloudflare's global network and is not restricted to any one country. Cloudflare's own data-localization compatibility list marks Workers AI as not compatible with Regional Services, the feature that confines processing to a region. So we cannot pin it to Canada or to the United States, and we will not imply otherwise. Everything else on the list above stays where its row says: your database, files and backups are in the United States. Cloudflare’s compatibility list is the source, read 2026-07-30.
Cloudflare does not store what is sent for inference unless the application writes it to a storage service itself. What comes back, we store in your workspace like any other message data, and delete with it.
On training, Cloudflare’s published Workers AI policy states: “Cloudflare does not use your Customer Content to (1) train any AI models made available on Workers AI or (2) improve any Cloudflare or third-party services.” We do not use message content or voicemail audio to train anything either. Transcripts and drafts are stored in your workspace like any other message data, and are deleted with it.
Every one of these features can be turned off for your whole workspace in Settings, and each has a monthly ceiling.
Changes
If we add or replace a sub-processor, we'll update this page and the date above. This list is the authoritative record of who processes data for Loonext.
Contact
Questions about our sub-processors or data handling? Email privacy@loonext.com.