Robocaller

Subprocessors

Every provider that processes personal data from your workspace for Gibox Oy: what it does, what it receives, where, and the transfer safeguard. This list is an annex to our data processing agreement.

Updated
Company
Gibox Oy, business ID 3522481-3
Access
Signed-in workspace admins

In short

  • Your workspace data is stored in the EU, in Finland and France. Call recordings are kept by Twilio, which may process them in the United States.
  • Some AI, telephony and LinkedIn connection providers process data outside the EU, mainly in the United States and in some cases Singapore or Israel, under the EU–US Data Privacy Framework, an adequacy decision, standard contractual clauses or binding corporate rules.
  • We email your admins at least 30 days before a new subprocessor starts, and you can object.
  • Services you connect yourself, such as Google, Microsoft and LinkedIn, aren’t on this list. They work under your own agreement with them.

Shared with customers under our data processing agreement. You can pass it on to your team, your auditors, authorities and the people whose data you process, and name these providers in your own privacy notice. Please don’t republish the list itself.

Email me about changes

On this page
  1. All subprocessors
  2. Not subprocessors
  3. Changes and objections
  4. Change log

All subprocessors

Grouped by the categories in our data processing agreement. Checked on 6 November 2026.

  • UpCloud Oy

    Hosting and database
    Purpose
    Runs the Robocaller app servers
    Role
    Subprocessor
    Personal data
    All workspace data while it is processed
    Location
    Helsinki, Finland
    Transfer safeguard
    Not needed: the data stays in the EU

  • Supabase Pte. Ltd.

    Hosting and database
    Purpose
    Database, sign-in and file storage
    Role
    Subprocessor
    Personal data
    All workspace data
    Location
    Paris, France; support and some of its own subprocessors outside the EU
    Transfer safeguard
    Standard contractual clauses

  • OpenAI Ireland Ltd

    AI services
    Purpose
    Transcribing calls, and writing emails and call notes
    Role
    Subprocessor
    Personal data
    Call audio, live and recorded, and prompts with contact and company names
    Location
    Ireland; processed in the United States
    Transfer safeguard
    Standard contractual clauses

  • Google (Gemini API)

    AI services
    Purpose
    AI for voice calls, sorting replies and the assistant
    Role
    Subprocessor
    Personal data
    Call conversations, reply texts and prompts
    Location
    Google data centres; location not fixed
    Transfer safeguard
    EU–US Data Privacy Framework and standard contractual clauses

  • Eleven Labs Inc.

    AI services
    Purpose
    The voice of AI calls
    Role
    Subprocessor
    Personal data
    The AI agent’s own words, which can include a contact’s name and company
    Location
    United States
    Transfer safeguard
    EU–US Data Privacy Framework and standard contractual clauses

  • Twilio Ireland Limited

    Telephony and messaging
    Purpose
    Calls, text messages and phone numbers
    Role
    Subprocessor. For call and message traffic data, and for its own security, compliance, product development and analytics uses of content, Twilio is an independent controller under its own terms
    Personal data
    Phone numbers, call audio and recordings, text messages
    Location
    Ireland; processed in the United States by Twilio Inc.
    Transfer safeguard
    EU–US Data Privacy Framework, binding corporate rules and standard contractual clauses

  • Unipile SAS

    LinkedIn connection
    Purpose
    Connects LinkedIn accounts and sends messages
    Role
    Subprocessor
    Personal data
    LinkedIn account session, profile IDs and messages
    Location
    France; its proxy providers in the United States, Singapore and Israel
    Transfer safeguard
    Standard contractual clauses for the United States and Singapore; adequacy decision for Israel

  • Icypeas

    Email address lookup
    Purpose
    Finds and checks work email addresses for your leads
    Role
    Subprocessor
    Personal data
    A name and company domain, or an email address to check
    Location
    France; some of its own providers outside the EU
    Transfer safeguard
    EU–US Data Privacy Framework or standard contractual clauses for its own providers

Not subprocessors

Some parties receive personal data but don’t process your workspace data on our behalf. They act under their own terms:

  • Google, Microsoft and LinkedIn, when you connect your own account. Robocaller reads and sends data through it on your instruction, and the provider handles that data under your own agreement with it.
  • Telephone network operators that carry your calls and text messages, and Twilio for call and message traffic data. They are independent controllers of that traffic data.
  • Stripe (card payments) and Maventa (e-invoicing), which handle our billing with your company and don’t receive your workspace data. Stripe is also an independent controller for fraud prevention, anti-money-laundering checks and some of its own purposes.
  • Public registers such as the Finnish trade register (PRH and YTJ) and Statistics Finland, which only receive search terms from us.

Changes and objections

At least 30 days before a new subprocessor starts processing your data, we email your workspace admins its name, what it will do and where, and update this page.

To object, email support@robocaller.io within those 30 days and tell us your data protection reason. We’ll look for a solution, such as not using the new provider for your workspace. If we can’t agree, you can end the affected service before the change takes effect.

Change log

  • 6 November 2026: list published as an annex to the data processing agreement.

Questions about this page?

Email support@robocaller.io.