Sub-processors

Last updated: 28 October 2026

These are the companies that process personal information for YesBusiness (XFACTORAI LLC) when we provide the Service, what each one does, which data it receives, where it processes it and where to read its own privacy terms. Our Privacy Policy, section 8 explains when each is used; section 9 explains international transfers.

Providers that process data for us

Provider	Purpose	Data	Location	Privacy
Anthropic	AI models and web search: the assistant's answers, research, drafts and the voice agent's model	What you ask, the content needed for the answer (for example an email or a document you ask about), the business profile	United States	anthropic.com/legal/privacy
ElevenLabs	Voice: calls, spoken replies, audio briefings, speech to text	Call audio, transcripts, the text read aloud, phone numbers on a call	United States	elevenlabs.io/privacy-policy
Twilio	Calls and texts: phone calls, call recordings, phone numbers, text and WhatsApp messages	Phone numbers, call audio and recordings, message text, call times	United States	twilio.com/legal/privacy
Recall.ai	Meetings: bringing Jasmine AI into a Zoom, Microsoft Teams or Google Meet meeting you send her to, recording it and making its transcript	The meeting link, the meeting's audio, chat and participants' names as shown in the meeting; the recording is deleted after at most 30 days	United States	recall.ai/privacy
Resend	Email: sending the emails we send (sign-in codes, notices, reports, approval requests) and receiving email sent to GIDEON	Email addresses, names, message content	United States	resend.com/legal/privacy-policy
Google	Gmail, Google Calendar and Google Contacts connections you choose; sign-in with Google (OAuth); Vertex AI for our video studio; Google Places for business look-ups; Google Analytics on public pages (only if you accept); Google Fonts; Firebase push to Android devices	For connections: the mail, calendar and contact data you allow. For video: your brief, photos and clips. For analytics: visits to public pages. For push: a device token	United States and Google's global regions	policies.google.com/privacy
Microsoft	Microsoft 365 connections you choose (Outlook mail, calendar, contacts); Microsoft Clarity on public pages (only if you accept analytics)	The mail, calendar and contact data you allow; for Clarity, how a visitor moves around a public page	United States and Microsoft's global regions	privacy.microsoft.com
Supabase	Database and backups: the accounts database (account records encrypted before they are stored) and the nightly encrypted backup of our app's stored files	Account records (encrypted), logins, the encrypted backup	Amazon Web Services, in our project's region (given with the DPA, or on request)	supabase.com/privacy
Fly.io	Hosting: the app servers and their stored files	Everything the app stores and processes	United States (Ashburn, Virginia)	fly.io/legal/privacy-policy
Stripe	Payments for credits and the monthly top-up	Name, email, card and billing details (held by Stripe; we never see the full card number)	United States	stripe.com/privacy
YesReel studio (our own video service, run by XFACTORAI)	Video renders: making videos from your brief, photos and clips, using Google (Vertex AI) and ElevenLabs	Your brief, photos, clips and the finished video; deleted 30 days after the project's last activity	Australia (Fly.io, Sydney)	Our Privacy Policy
OpenAI	Speech to text when our main voice provider is not available	Audio you record or a voice message	United States	openai.com/policies/privacy-policy
Cloudflare	Receiving and routing email sent to GIDEON's address; the cdnjs script library	Email sent to GIDEON; your IP address when a page loads a library	United States and Cloudflare's global network	cloudflare.com/privacypolicy
Our lead and business data service, using Explorium, Apollo, Hunter, Google Places and GLEIF	Finding leads, business details and company records	The search you run (a company name, an industry, a place); never your contacts' private details	United States (GLEIF: Switzerland)	Explorium, Apollo, Hunter, Google, GLEIF
OpenStreetMap (Nominatim and map tiles)	Turning an address into a place on a map	The address text for a lookup; your IP address when a map loads	United Kingdom and the OpenStreetMap Foundation's hosts	osmfoundation.org privacy policy
Apple, Google and Mozilla push services	Delivering notifications to your devices	A device token and the notification text	United States	Apple, Google, Mozilla
Google Fonts and public script libraries (jsDelivr, cdnjs)	Fonts and page code loaded by your browser	Your IP address and browser details	Global networks	Google, jsDelivr, cdnjs (Cloudflare)
Google Analytics and Microsoft Clarity	Measuring and recording visits to our public pages	Visits, clicks and scrolling on public pages, only if you press Accept	United States	Google, Microsoft

Services you connect yourself (another mail provider by IMAP, Basiq or Plaid and your bank, Xero or Intuit QuickBooks, LinkedIn or Facebook, websites GIDEON opens for you) receive what you send them under their own terms; they are listed in Privacy Policy section 8 under "Services you connect or choose".

A data processing agreement for business customers

Business customers who need a data processing agreement (for example under Article 28 of the EU or UK GDPR) write to support@yesbusiness.ai and we sign our standard DPA. It is available on request; it covers the providers on this page, the Standard Contractual Clauses for transfers, security, breach notice and deletion at the end of the service.

We update this page before we add a provider that processes personal information for us. A business customer that has signed our DPA can ask to be told by email when it changes.