Legal
Sub-processor List
Last Updated: March 27, 2026
Third-party entities engaged by Callengo to process personal data on behalf of customers. Maintained in accordance with GDPR Article 28(3)(d) and the Callengo Data Processing Addendum. Callengo provides at least 30 days' advance notice of any addition or material change.
RISK LEVEL LEGEND
HighCore data processor; access to all or most personal data
MediumProcesses specific personal data categories
LowMinimal or no direct personal data access
ConditionalOnly active when customer explicitly enables the integration
1. Core Infrastructure
Always active. Process personal data across all customer accounts and all features of the Service.
Supabase, Inc.
United States (Delaware)
ServicePrimary relational database (PostgreSQL), managed authentication service, real-time subscriptions, and file storage. Hosts all application data.
Data ProcessedAll categories of personal data processed by the Callengo platform: account holder identifiers, contact personal data (name, phone, email, address, transcripts), integration OAuth credentials (encrypted), billing metadata.
Processing LocationUnited States (AWS US-East-1)
Transfer MechanismEU-US Data Privacy Framework; Standard Contractual Clauses
Vercel, Inc.
United States (Delaware)
ServiceServerless application hosting and edge compute. Both the Callengo marketing website (callengo.com) and the Application (app.callengo.com) are hosted on Vercel's infrastructure, including all API serverless functions.
Data ProcessedAll personal data in transit through the platform and website. Vercel runtime logs may incidentally capture request metadata, IP addresses, and user-agent strings from website visitors.
Processing LocationUnited States (primary); global edge network for CDN
Transfer MechanismEU-US Data Privacy Framework; Standard Contractual Clauses
Upstash, Inc.
United States (Delaware)
ServiceManaged Redis cache used for call concurrency tracking, distributed rate limiting, contact call cooldown enforcement, and caching of platform configuration data.
Data ProcessedNon-identifying UUIDs used as cache keys; IP addresses used for rate limiting; operational counters. No contact PII is stored.
Processing LocationUnited States (AWS US-East-1)
Transfer MechanismStandard Contractual Clauses
2. Authentication and Identity
Engaged in connection with user authentication and social login functionality.
Google LLC (Sign in with Google)
United States (Delaware)
ServiceOAuth 2.0 social login. When users sign in with their Google account, Google authenticates the user and returns an identity token to Callengo.
Data ProcessedEmail address; display name; Google account identifier.
Processing LocationUnited States; Google global infrastructure
Transfer MechanismEU-US Data Privacy Framework; Standard Contractual Clauses
Microsoft Corporation (Sign in with Microsoft)
United States (Washington)
ServiceOAuth 2.0 social login via Microsoft Azure Active Directory.
Data ProcessedEmail address; display name; Microsoft account identifier; tenant ID.
Processing LocationUnited States; Microsoft global infrastructure
Transfer MechanismEU-US Data Privacy Framework; Standard Contractual Clauses; EU Model Clauses
Google LLC (reCAPTCHA v3)
United States (Delaware)
ServiceInvisible bot detection on the Application registration form. Processes browser behavioral signals to generate a risk score.
Data ProcessedIP address; browser fingerprint signals on the registration page only.
Processing LocationUnited States; Google global infrastructure
Transfer MechanismEU-US Data Privacy Framework; Standard Contractual Clauses
3. Voice Calling Infrastructure
Executes all outbound AI Voice Agent calls. Highest-sensitivity sub-processor due to access to call audio, transcripts, and contact personal data.
Intelliga Corporation (Bland AI)
United States (Delaware)
ServiceAI voice call execution, real-time transcription, recording storage, voicemail detection. All outbound AI Voice Agent calls are dispatched to and executed by Bland AI. Bland AI records all calls by default, generates transcripts, and returns call outcomes to Callengo via webhook.
Data ProcessedContact telephone numbers; contact names and personal data fields embedded in AI agent task prompts; call audio recordings; call transcripts (which may contain any personal information disclosed by the Contact during the conversation); call metadata.
Processing LocationUnited States
Transfer MechanismStandard Contractual Clauses (incorporated in Bland AI DPA)
DPA confirmed executed. Full DPA published at bland.ai/legal/data-processing-agreement. Key provisions: purpose limitation; no sale/sharing of Customer Personal Data; deidentified data carve-out; SCCs for EU/EEA/UK/Switzerland transfers; breach notification; deletion within 14 days of service cessation upon request to compliance@bland.ai; SOC 2 Type II audit rights.
4. AI Analysis
Processes call transcripts and contact data to perform post-call analysis and power the in-app AI assistant.
OpenAI, LLC
United States (Delaware)
ServiceAI language model inference for post-call intent analysis, lead qualification scoring, full call deep analysis, contact data quality assessment, agent configuration recommendations, campaign context suggestions, and the Cali AI in-app conversational assistant. When the Cali AI assistant is used, the request to OpenAI includes the user's typed message, conversation history, and company profile data including team member names and email addresses.
Data ProcessedCall transcripts (which may contain Contact personal data); contact metadata; account holder business profile data; team member names and email addresses (via Cali AI assistant context); user-typed messages to the Cali AI assistant.
Processing LocationUnited States
Transfer MechanismStandard Contractual Clauses
Training data sharing confirmed disabled (verified March 25, 2026): all three data sharing options are disabled in Callengo's OpenAI organization settings. API call logging is enabled — prompts and completions are retained by OpenAI for up to 30 days for the organization's own review. This retention period is not used for model training.
5. Payments
Handles all subscription billing and payment processing.
Stripe, Inc.
United States (Delaware)
ServiceSubscription billing, payment processing, invoice generation, and customer billing portal. Stripe collects and processes payment card data directly through Stripe Checkout. Callengo never receives or stores raw payment card data. Stripe contact, invoice, and product data is synced to HubSpot for internal CRM and reporting purposes.
Data ProcessedCardholder name; billing email address; billing address; payment method type and last four digits; subscription metadata; invoice data; product catalog data synced to HubSpot.
Processing LocationUnited States; Stripe global infrastructure
Transfer MechanismEU-US Data Privacy Framework; Standard Contractual Clauses
6. Email Delivery
Delivers transactional emails on behalf of Callengo.
Resend, Inc.
United States (Delaware)
ServiceTransactional email delivery. Resend is configured as the custom SMTP provider for Callengo's authentication service (Supabase Auth), routing all authentication and account management emails through Resend's infrastructure using the noreply@callengo.com sender address. Emails delivered: account email verification, password reset links, magic links, and team invitation emails.
Data ProcessedRecipient email address; email content (authentication links and invitation details); email delivery metadata.
Processing LocationUnited States
Transfer MechanismStandard Contractual Clauses
7. Analytics
Used to understand how customers and visitors interact with the Callengo Application and Website.
PostHog, Inc.
United States (Delaware)
ServiceProduct analytics and session recording for the Application (app.callengo.com). Users are identified by a pseudonymized UUID (not email). Session recordings are captured with mandatory masking of password, email input, and phone number fields.
Data ProcessedPseudonymized user UUID; first name; company UUID and name; subscription plan; usage behavior events; session recordings (with sensitive fields masked); IP address; browser and device metadata.
Processing LocationUnited States (PostHog Cloud US)
Transfer MechanismEU-US Data Privacy Framework; Standard Contractual Clauses
Google LLC (Google Analytics 4)
United States (Delaware)
ServiceWeb analytics for the Callengo Website (callengo.com) and Application (app.callengo.com). Tracks page views, user behavior, and conversion events. IP addresses are anonymized by default in GA4. GA4 is loaded on the Website subject to cookie consent managed by Usercentrics.
Data ProcessedPseudonymized user UUID (not email); subscription plan; page views; behavioral events; IP address (anonymized); browser and device metadata; referral source; session duration.
Processing LocationUnited States; Google global infrastructure
Transfer MechanismEU-US Data Privacy Framework; Standard Contractual Clauses
Google LLC (Google Tag Manager)
United States (Delaware)
ServiceTag management system for the Callengo Website (callengo.com), container GTM-MXFGV52S. GTM orchestrates the loading of analytics, advertising, and consent tags in compliance with cookie consent preferences managed by Usercentrics. GTM itself does not collect personal data.
Data ProcessedGTM does not directly process personal data. It manages the loading of other tags (GA4, LinkedIn Insight Tag, Google Ads, HubSpot tracking) that may process personal data.
Processing LocationUnited States; Google global infrastructure
Transfer MechanismEU-US Data Privacy Framework; Standard Contractual Clauses
8. CRM and Marketing (Internal Operations)
Used by Callengo for its own internal business operations. Distinct from the HubSpot CRM integration available to Callengo customers.
HubSpot, Inc. (Internal CRM)
United States (Delaware)
ServiceInternal CRM and marketing platform (Portal 147914572, EU1 region). Callengo uses HubSpot to manage its own business customer relationships, track sales pipeline, process contact form submissions, manage email marketing communications, and track website visitor behavior on callengo.com. Account holder data may be synchronized to Callengo's internal HubSpot account. HubSpot sets tracking cookies on callengo.com for lead identification and visitor analytics, subject to cookie consent managed by Usercentrics. HubSpot also receives synced data from Smartlead (cold email outbound), Stripe (payment/invoice data), Google Ads, and LinkedIn Ads.
Data ProcessedAccount holder email address; company name; subscription plan; account status; web form submission data from callengo.com; website visitor tracking data (pages viewed, session data); email engagement metrics; Stripe payment and invoice data; Google Ads and LinkedIn Ads attribution data.
Processing LocationUnited States; HubSpot EU1 region (EU data residency)
Transfer MechanismEU-US Data Privacy Framework; Standard Contractual Clauses
9. Conditional Integration Sub-processors
Only activated when a customer voluntarily connects the corresponding integration. No data is processed unless the customer explicitly enables the integration.
Google LLC (Google Calendar / Google Sheets)
United States (Delaware)
ServiceCalendar synchronization and spreadsheet contact import. Activated when a customer connects their Google account.
Data ProcessedCalendar event data; Google account email; OAuth credentials (encrypted at rest). For Sheets: spreadsheet row data mapped to contact fields.
Processing LocationUnited States; Google global infrastructure
Transfer MechanismEU-US Data Privacy Framework; Standard Contractual Clauses
Microsoft Corporation (Outlook / Dynamics 365)
United States (Washington)
ServiceMicrosoft Outlook calendar synchronization and Microsoft Dynamics 365 CRM contact import.
Data ProcessedCalendar event data; Microsoft account email and tenant ID; Dynamics 365 contact records (name, email, phone, company, address); OAuth credentials (encrypted at rest).
Processing LocationUnited States; Microsoft global infrastructure
Transfer MechanismEU-US Data Privacy Framework; Standard Contractual Clauses; EU Model Clauses
HubSpot, Inc. (HubSpot CRM Integration)
United States (Delaware)
ServiceBidirectional CRM contact synchronization. Callengo reads HubSpot contact records and may write call outcomes, activity logs, and lifecycle stage updates back.
Data ProcessedHubSpot contact records (name, email, phone, company, deal stage, owner); OAuth credentials (encrypted at rest); call outcome data written back to HubSpot.
Processing LocationUnited States; HubSpot global infrastructure
Transfer MechanismEU-US Data Privacy Framework; Standard Contractual Clauses
Salesforce, Inc. (Salesforce CRM Integration)
United States (Delaware)
ServiceCRM contact import. Callengo reads contact and lead records from the customer's Salesforce organization (currently read-only).
Data ProcessedSalesforce contact and lead records (name, email, phone, company, address, owner); OAuth credentials (encrypted at rest).
Processing LocationUnited States; Salesforce global infrastructure
Transfer MechanismEU-US Data Privacy Framework; Standard Contractual Clauses
Pipedrive, Inc. (Pipedrive CRM Integration)
Estonia (EU)
ServiceBidirectional CRM contact synchronization. Callengo reads Pipedrive person records and may write call outcomes back.
Data ProcessedPipedrive person records (name, email, phone, company, deal stage); OAuth credentials (encrypted at rest); call outcome data.
Processing LocationEuropean Union; Pipedrive global infrastructure
Transfer MechanismNo Restricted Transfer (Pipedrive incorporated in EU)
Zoho Corporation (Zoho CRM Integration)
India
ServiceCRM contact import and bidirectional sync. Callengo reads contact and lead records and may write call outcomes back to Zoho.
Data ProcessedZoho CRM contact and lead records (name, email, phone, address, company); organizational settings for field mapping; OAuth credentials (encrypted at rest).
Processing LocationUnited States; India; Zoho global infrastructure
Transfer MechanismStandard Contractual Clauses
Themis Solutions Inc. (Clio Legal CRM)
Canada (British Columbia)
ServiceLegal CRM contact import for law firm customers. Callengo reads client and matter records from Clio. Data may include legally sensitive client information.
Data ProcessedClio client records (name, email, phone, address, matter details, firm information); OAuth credentials (encrypted at rest).
Processing LocationCanada; United States
Transfer MechanismAdequacy decision for Canada (PIPEDA); Standard Contractual Clauses
SimplyBook.me, Ltd. (SimplyBook Integration)
Cyprus (EU)
ServiceAppointment scheduling contact import. Callengo imports booking client records as contacts for appointment confirmation campaigns.
Data ProcessedSimplyBook client records (name, email, phone, booking details); API session token (encrypted at rest).
Processing LocationEuropean Union
Transfer MechanismNo Restricted Transfer (SimplyBook incorporated in EU)
Zoom Video Communications, Inc. (Zoom Integration)
United States (Delaware)
ServiceVideo meeting link generation for appointment confirmation campaigns.
Data ProcessedZoom account identity; meeting metadata (title, time, duration); OAuth credentials (encrypted at rest).
Processing LocationUnited States; Zoom global infrastructure
Transfer MechanismEU-US Data Privacy Framework; Standard Contractual Clauses
Slack Technologies, LLC (Slack Notification Integration)
United States (Delaware)
ServiceIn-app notification delivery to customer Slack workspaces. Sends call completion and campaign notifications.
Data ProcessedSlack workspace identity; channel identifiers; OAuth credentials (encrypted at rest); notification content (call outcome summaries, contact names as configured by customer).
Processing LocationUnited States; Slack global infrastructure
Transfer MechanismEU-US Data Privacy Framework; Standard Contractual Clauses
10. Website Services (callengo.com)
Third-party services that process personal data on the Callengo marketing website (callengo.com). These services are distinct from the Callengo Application (app.callengo.com) and operate subject to visitor cookie consent where applicable.
Usercentrics GmbH
Germany (EU)
ServiceCookie consent management platform (CMP) deployed on callengo.com (Settings ID yQ0u7kXv9rUwXL). Manages visitor consent preferences for analytics, advertising, and functional cookies in compliance with GDPR, ePrivacy Directive, and CCPA. Controls the activation of all other website tracking tags via Google Tag Manager.
Data ProcessedConsent preferences (opt-in/opt-out choices); pseudonymized device identifier; IP address (for geolocation-based consent rules); browser metadata.
Processing LocationEuropean Union (Germany)
Transfer MechanismNo Restricted Transfer (Usercentrics incorporated and data hosted in the EU)
Google LLC (Google Fonts)
United States (Delaware)
ServiceFont delivery service for the Callengo marketing website. Serves the Inter, Poppins, and JetBrains Mono typefaces to website visitors. Each page load triggers a request to Google's font servers.
Data ProcessedIP address of website visitor; browser user-agent string; referrer URL. No cookies are set by Google Fonts.
Processing LocationUnited States; Google global CDN
Transfer MechanismEU-US Data Privacy Framework; Standard Contractual Clauses
Google Fonts requests are made directly from the visitor's browser to Google servers. Google states that font requests are not logged or associated with user accounts.
LinkedIn Corporation (LinkedIn Insight Tag)
United States (California) — subsidiary of Microsoft Corporation
ServiceConversion tracking and audience building pixel deployed on callengo.com via Google Tag Manager. Tracks website visitor actions for LinkedIn Ads campaign attribution, retargeting audience creation, and demographic insights. Activated only after visitor consent.
Data ProcessedLinkedIn member identifier (hashed); IP address; browser and device metadata; page URLs visited; conversion event data; referral source.
Processing LocationUnited States; LinkedIn/Microsoft global infrastructure
Transfer MechanismEU-US Data Privacy Framework; Standard Contractual Clauses
Google LLC (Google Ads)
United States (Delaware)
ServiceAdvertising platform (Account 210-899-4003) connected to HubSpot. Google Ads conversion tracking and remarketing tags are deployed on callengo.com via Google Tag Manager to measure ad campaign performance and build retargeting audiences. Activated only after visitor consent.
Data ProcessedGoogle click identifier (GCLID); IP address; browser and device metadata; page URLs visited; conversion event data; ad interaction data synced to HubSpot.
Processing LocationUnited States; Google global infrastructure
Transfer MechanismEU-US Data Privacy Framework; Standard Contractual Clauses
LinkedIn Corporation (LinkedIn Ads)
United States (California) — subsidiary of Microsoft Corporation
ServiceAdvertising platform with two accounts connected to HubSpot. Manages sponsored content and InMail campaigns targeting prospects. Campaign performance and lead data are synced to HubSpot for attribution and pipeline tracking.
Data ProcessedLinkedIn campaign performance data; lead form submission data (name, email, company, job title); ad interaction and conversion data synced to HubSpot.
Processing LocationUnited States; LinkedIn/Microsoft global infrastructure
Transfer MechanismEU-US Data Privacy Framework; Standard Contractual Clauses
Smartlead.ai
United States
ServiceCold email outbound platform used by Callengo for its own sales outreach. Prospect contact data is managed in Smartlead and synced to HubSpot via webhook for centralized CRM management and pipeline tracking.
Data ProcessedProspect email addresses; names; company information; email engagement data (opens, clicks, replies); data synced to HubSpot via webhook.
Processing LocationUnited States
Transfer MechanismStandard Contractual Clauses
Smartlead processes data for Callengo's own outbound sales operations only, not on behalf of Callengo customers. Prospect data originates from Callengo's own prospecting activities and is synced to HubSpot for unified CRM management.
Change Log
| Date | Change | Sub-processor Affected |
|---|---|---|
| March 27, 2026 | Added Section 10 (Website Services): Usercentrics, Google Fonts, LinkedIn Insight Tag, Google Ads, LinkedIn Ads, Smartlead. Updated existing entries for Vercel, Google Analytics 4, Google Tag Manager, HubSpot (Internal CRM), and Stripe to reflect website data processing and cross-service data flows. | Usercentrics GmbH; Google LLC (Fonts, Ads); LinkedIn Corporation (Insight Tag, Ads); Smartlead.ai; Vercel; HubSpot (Internal CRM); Stripe; GA4; GTM |
| March 25, 2026 | Initial publication | All platform sub-processors (Sections 1–9) |
Questions and Objections
For questions about this sub-processor list, to subscribe to email notifications of future changes, or to exercise your right to object to a new sub-processor under the Data Processing Addendum, contact:
EntityFuentes Digital Ventures LLC (Callengo)
Emaillegal@callengo.com
This Sub-processor List was last updated on March 27, 2026. It forms part of Callengo's privacy documentation alongside the Privacy Policy, Terms of Service, Cookie Policy, and Data Processing Addendum.