Subprocessors and Infrastructure

This notice lists the major categories of service providers Ottocal may use in normal operation. The exact providers involved in a given workflow can vary by feature, region, account configuration, or environment.

• Vercel for web hosting, builds, and application delivery.
• Supabase for database, authentication, storage, and core application state.
• Stripe for payment processing, invoices, payouts, and related payment operations.
• Resend or similar email infrastructure for transactional messaging.
• LiveKit for in-app call rooms and media workflows.
• ElevenLabs for voice booking agents and spoken briefs where enabled.
• Vercel AI Gateway, which routes AI requests to the model providers below on our behalf.
• Model and transcription providers reached through that gateway, which may include Amazon Web Services, Google Cloud, Microsoft Azure, Baseten, Fireworks AI, DeepInfra, OpenAI, Anthropic, and Deepgram, for generation, extraction, summaries, or transcription where enabled.
• Sentry for application monitoring, diagnostics, and error reporting.

AI requests are restricted to a reviewed list of inference providers and are pinned to data centres in the United States, where inference runs and where any data those providers retain at rest is stored. A request that cannot be served under those conditions fails rather than being processed elsewhere.

Those providers are also instructed not to retain prompts or outputs after a request completes, and not to use them for model training. Audio transcription is the one exception to the location restriction, because no transcription provider currently supports it; the retention and no-training instructions still apply. Providers may separately retain material they flag for abuse or safety review under their own policies.

Depending on the workflow, providers may process account identifiers, booking records, emails, payment metadata, room identifiers, recordings, transcripts, prompts, AI outputs, logs, browser metadata, or system diagnostics.

Each provider operates under its own terms, privacy commitments, geographic footprint, and security model. Data may be stored or processed in the United States or other regions where those providers operate.

Ottocal may add, remove, or replace providers as the product evolves. Material updates to this notice may be posted here with an updated date.

Questions about Ottocal's service providers or data-processing chain can be sent to hello@ottocal.com.