# Sub-processors

**List in force as of 23 October 2026**

This is a translation. In case of discrepancy, the Spanish version prevails.

Service providers that process personal data on behalf of InvokeApp when providing the service. This is the Sub-processor Annex referred to in clause 16.2 of the [Terms of Service](https://invokeapp.io/terms) and Annex C of the [Data Processing Agreement](https://invokeapp.io/dpa). Any addition or replacement is notified 30 days in advance (clause 16.3 of the Terms of Service and clause 7.2 of the Agreement).

| Provider | Service | Data | Processing location | Safeguard outside the EEA |
|---|---|---|---|---|
| Google Cloud EMEA Limited (Ireland) | Hosting of the platform and the agents: compute, database, files, queues, scheduled tasks, secrets, logs and backups; website hosting | All platform data | European Union: Madrid (`europe-southwest1`) for compute, database and files; Belgium (`europe-west1`) for task queues and scheduled tasks; messages between the platform and the agents (Pub/Sub), in the region closest to the publisher (today, Madrid), with no fixed region configured; backups in the European Union multi-region. Technical logs and secrets: Google Cloud's global location. The website is served from Firebase's global content delivery network (the blog, from the Netherlands, `europe-west4`) | Google Cloud data processing terms; standard contractual clauses and Data Privacy Framework for processing in or access from third countries |
| Google Cloud EMEA Limited — Vertex AI (Gemini models) and Cloud Text-to-Speech | Artificial intelligence features (including transcription of voice dictation) and text-to-speech | Only the content each feature needs: text and, in voice or image features, the dictated audio (not stored) or the images provided | European Union: Belgium (`europe-west1`); the Netherlands (`europe-west4`) as a fallback for image generation; text-to-speech through the EU endpoint | Same as above. No training with customer data |
| Google Cloud EMEA Limited — Vertex AI (Veo model) | Video generation, only if the company enables that feature | The instructions and brand images sent for the video | United States (`us-central1`) | Standard contractual clauses and Data Privacy Framework |
| Google Ireland Limited — Google Workspace | Email sent by InvokeApp (platform notices and communications) | Email address, name and message content | European Union and United States | Standard contractual clauses and Data Privacy Framework |
| Brevo (Sendinblue SAS, France) | Sending email from the invokeapp.io domain (platform notices and communications) | Email address, name and message content | European Union | — |
| Stripe Payments Europe, Ltd. (Ireland) | Payments and subscriptions | Billing and payment data | European Union and United States | Standard contractual clauses and Data Privacy Framework. Stripe is an independent controller for its own legal obligations |
| Meta Platforms Ireland Limited | WhatsApp Business Platform | Phone numbers, messages, templates and account identifiers | European Union and United States | Meta processor terms; Data Privacy Framework and standard contractual clauses |
| Twilio Ireland Limited | WhatsApp and SMS for the receptionist and appointment management | Phone numbers and message content | European Union and United States | Standard contractual clauses and Data Privacy Framework |
| 360dialog GmbH (Germany) | Alternative WhatsApp provider, only if the customer chooses it | Phone numbers and messages | European Union | — |

## Recipients that act as independent controllers

They are not sub-processors: they receive the data under their own terms and decide on it as independent controllers. They are listed here because the data leaves the EEA without a Chapter V GDPR safeguard in place.

| Recipient | Use by InvokeApp | Data they receive | Location | Safeguard outside the EEA |
|---|---|---|---|---|
| Telegram FZ-LLC (United Arab Emirates) | Internal technical alerts for the InvokeApp team | Event codes, internal identifiers and technical error messages, which may contain customer data (for example, the text of an exception or a provider's response when an account is connected). Some alerts also include contact details (email, name) and the text of website forms and support tickets. Until the next deployment of the platform and its agents, all of this may arrive unmasked. From that deployment onwards, before each alert is sent, email addresses, phone numbers, identity documents (Spanish DNI and NIE), tax IDs (CIF), IBANs, card numbers, social security numbers, IP addresses and keys or tokens that are recognised by their format will be masked; people's names and the free text of forms and tickets are not recognised that way and may still arrive, although truncated | Outside the EEA | None in place: according to its privacy policy, Telegram acts as an independent controller and does not sign processing agreements or standard contractual clauses with those who use its bots |

## Third parties that receive data only when the company enables a feature

They are not sub-processors: they process the queries under their own terms, not on behalf of InvokeApp.

| Third party | InvokeApp feature | Data they receive | Location | Regime |
|---|---|---|---|---|
| Google — Google Maps Platform (Places API) and Custom Search JSON API | Lead prospecting and enrichment, only if the company enables those features | Search terms: sector, area and the lead's business name (which, for a sole trader, may be a person's name) | Global | Google processes these queries under its own terms, not as InvokeApp's processor (for Google Maps Platform, as an independent controller). Google LLC participates in the Data Privacy Framework |

Services the customer connects with its own account (for example its Gmail or Google Calendar, HubSpot, Salesforce, Typeform, Slack, its Brevo or Mailchimp account, Calendly, WordPress, its social networks, its Telegram channel or its Meta app) are not listed: there the provider works for the customer, not for InvokeApp. Importing a CSV file (for example from Apollo.io) does not connect InvokeApp to that provider.