DialLink Sub-processors & Third-Party Services
Version 2.0 · Last updated November 2, 2026 · Previous versions: Legal Archive
This page lists (A) the sub-processors DialLink Corp. uses to process Customer Data on behalf of our customers under the Data Processing Addendum, (B) the third-party services we use for our websites and business operations, where DialLink is the controller, and (C) the integrations you can connect yourself, which are not sub-processors. We update this page before a new sub-processor processes Customer Data and notify Account Administrators at least 30 days in advance, as the DPA provides.
Subscribe to change notifications: email privacy@diallink.com with the subject "Subscribe to sub-processor updates" from your Administrator address.
A. Sub-processors of Customer Data
| Sub-processor | Function | Data processed | Location of processing | Safeguards and retention |
|---|---|---|---|---|
| Amazon Web Services, Inc. | Cloud infrastructure: hosting, databases, object storage for recordings and voicemails, message streaming, search and logging, reporting warehouse, backups, and our self-hosted knowledge-base search index | All Customer Data | United States (US East, N. Virginia) | DPA with Standard Contractual Clauses (SCCs); facilities certified under SOC 2 and ISO 27001; data kept until we delete it (database backups 30 days; logs 7 days to 12 months) |
| Twilio Inc. | Voice carrier services, phone numbers, SMS/MMS, WhatsApp Business connectivity (as WhatsApp Business Solution Provider), number porting, 911 routing, STIR/SHAKEN call signing, messaging and caller-ID registration (Trust Hub, including submission of brand and campaign data to The Campaign Registry and carriers), call recording and voicemail capture | Call audio, call recordings and voicemails, numbers and call metadata, message content and metadata, Registered Locations for 911, messaging and caller-ID registration data (business details, tax identification number, sample messages, consent descriptions) | United States | DPA with SCCs; recordings and voicemails are copied to our own storage and deleted from Twilio within minutes of the call; Twilio keeps call and message logs for 13 months |
| Meta Platforms, Inc. (WhatsApp Business Platform), through Twilio | Delivery of WhatsApp messages you send and receive through the Services | WhatsApp message content and metadata, the WhatsApp Business Account details registered for you | United States / Meta's global infrastructure | Your WhatsApp Business Account is created in your own Meta Business Manager under Meta's WhatsApp Business terms, which you accept during setup; messages are end-to-end encrypted on WhatsApp's network |
| Telephone Science Corporation (Nomorobo), through Twilio | Spam scoring of inbound calls | The calling party's phone number | United States | Twilio marketplace terms and Nomorobo's data processing addendum; query data kept up to 30 days |
| OpenAI, L.L.C. | Large language, speech-to-speech, transcription and text-to-speech models for AI Voice Agents and AI Messaging Agents (customer-selectable) and for AI Call Intelligence (summaries, action items, sentiment, speaker names, call tagging, contact extraction, automatic replies) | Call audio for live AI Agent calls, transcribed call and message content, AI Agent instructions and knowledge content, conversation context | United States | API terms (OpenAI Services Agreement): no training on our inputs or outputs; inputs and outputs retained up to 30 days for abuse monitoring and conversation state, then deleted; usage policies: openai.com/policies/usage-policies |
| xAI (X.AI Corp.) | Speech-to-text transcription of call recordings and voicemails (Grok transcription, with speaker identification); Grok voice models for AI Voice Agents (customer-selectable) | Call audio, transcribed content, AI Agent instructions and knowledge content, conversation context | United States | Enterprise API terms: no training on our inputs or outputs; API requests and responses retained 30 days, then deleted; acceptable use policy: x.ai/legal/acceptable-use-policy |
| Anthropic, PBC | Claude language models used as the reasoning model for AI Voice Agents (customer-selectable) and for AI Messaging Agents and automatic replies | Transcribed call and message content, AI Agent instructions and knowledge content, conversation context (no audio) | United States | Commercial API terms: no training on our inputs or outputs; inputs and outputs retained up to 30 days, then deleted; usage policy: anthropic.com/legal/aup |
| ElevenLabs, Inc. | Text-to-speech voices for AI Voice Agents | The text of AI Agent responses converted to speech (no Caller audio) | United States | API terms; our account is configured so that our content is not used to improve ElevenLabs' models; generated speech history retained in our account until we delete it |
| ScraperAPI, LLC | Retrieval of the web pages you add to an AI Knowledge Base | The public web addresses you supply and the page content fetched from them | Not stated by the vendor | Vendor terms; request logs kept 7 days; fetched page content may be retained by the vendor |
| Twilio SendGrid | Email delivery: product emails from the Services (notifications, voicemail and transcript emails where enabled) and, through a separate account, marketing email | Email addresses, notification content | United States | DPA with SCCs |
| Google LLC (Firebase Cloud Messaging) and Apple Inc. (Apple Push Notification service) | Delivery of push notifications to the mobile apps | Device push tokens and notification content (for example caller name and number, message preview) | United States / global | Google and Apple developer terms; notifications are not retained after delivery |
| Microsoft Corporation (Power BI, Microsoft 365, Teams) | Internal business and finance reporting dashboards built on nightly copies of production records; email and Teams used by our staff, including for support correspondence | Account, user, call, message, billing and usage records in the reporting copies; Customer Data that customers share in support correspondence | United States | Microsoft Product Terms and Data Protection Addendum; reporting snapshots kept 3 days, export files and dashboards until we delete them |
| Intercom, Inc. | Customer support messaging, help center, in-app onboarding and product messages | Account and contact details, plan and onboarding status, usage events used to trigger onboarding messages; Customer Data that customers share in support conversations | United States | DPA with SCCs |
| Functional Software, Inc. (Sentry) | Error and performance monitoring | Technical and diagnostic data, which may include user identifiers, IP addresses and fragments of request data in error reports | United States | DPA with SCCs; error data retained 90 days |
| Atlassian Pty Ltd (Jira, Confluence) | Engineering issue tracking and internal documentation | Fragments of Customer Data when staff include them in a ticket (for example phone numbers, screenshots or recordings attached to a bug report) | Atlassian Cloud (United States / global) | DPA with SCCs; access limited to engineering and support staff; kept until deleted |
| Engineering and support contractors engaged by DialLink | Software development, maintenance and technical support of the Services, performed by contractor personnel working under DialLink's direction and access controls | Access to production systems and Customer Data only to the extent needed for development, maintenance and support | United States; some contractor personnel access our systems remotely from outside the United States | Written agreements with confidentiality and data protection obligations; access controls per Annex II of the DPA; access ends with the engagement. Customers under the DPA may request further information about these contractors, subject to confidentiality. |
Infrastructure tools that do not process Customer Data (listed for transparency; not sub-processors): GitHub (source code and build automation), Doppler (secrets management), Asana (internal project management).
Removed since the previous version: FullContact Inc. (contact enrichment) — no longer used.
B. Third-party services for our websites and business operations (DialLink as controller)
These providers process Account Data, website visitor data or marketing data under our Privacy Policy. They do not process Customer Data.
| Provider | Purpose | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Stripe, Inc. | Payment processing, invoicing, subscription billing, prepaid balances and desk-phone orders; sales-tax calculation (Stripe Tax) | Billing details, payment method data (held by Stripe), transaction history, company name, phone number, billing and shipping addresses, account identifier and tax line items | United States | EU-U.S. Data Privacy Framework / SCCs per Stripe's data terms |
| Wolters Kluwer — CCH Incorporated (SureTax) | Telecommunications tax calculation and reporting for invoices | Billing address, invoice line amounts and types, Stripe customer and invoice identifiers (no names, email addresses, numbers or call records) | United States | Subscription agreement |
| Salesforce, Inc. | Customer relationship management: sales pipeline, trial and customer records, reporting | Contact and company details, address, tax identification number, sign-up attribution, verification and security flags, subscription and revenue figures, sign-in activity | United States | EU-U.S. Data Privacy Framework / SCCs per Salesforce's data terms |
| Google LLC — Google Tag Manager, Google Analytics, Google Ads, Google Search Console, Looker Studio; Google Cloud (sign-in with Google) | Tag management, website analytics and reporting, advertising measurement and remarketing; authentication when you choose "Continue with Google" | Cookie identifiers, device and browsing data on diallink.com and on the sign-up and onboarding pages of the web application; for sign-in, the name and email address of your Google account (OAuth scopes: openid, email, profile) | United States | EU-U.S. Data Privacy Framework / SCCs per Google's data terms |
| Google LLC — Google Workspace | Business productivity tools for the diallink.com domain | Correspondence and documents of our staff | United States | EU-U.S. Data Privacy Framework / SCCs per Google's data terms |
| Microsoft Corporation — Microsoft Clarity; sign-in with Microsoft | Website session replays and heatmaps on diallink.com (loaded after consent); authentication when you choose "Continue with Microsoft" | Cookie identifiers, device and interaction data on diallink.com; for sign-in, the name and email address of your Microsoft account (OAuth scopes: openid, profile, offline_access, User.Read) | United States | EU-U.S. Data Privacy Framework / SCCs per Microsoft's data terms |
| Apple Inc. (App Store, sign in with Apple) and Google LLC (Google Play) | Distribution of the mobile apps; authentication when you choose "Continue with Apple" | App analytics (aggregated), crash reports; for sign-in, the identifier, name and (if you share it) email address of your Apple ID | United States | Apple and Google developer terms |
| Stape, Inc. | Hosting of our server-side Google Tag Manager container (server-side tracking) | Website visitor identifiers, events and device data relayed to analytics and advertising partners | United States | SCCs / DPA per Stape's terms |
| Meta Platforms, Inc. — Meta Pixel and Conversions API | Advertising measurement and remarketing | Cookie identifiers, device, page and event data on diallink.com and the sign-up and onboarding pages of the web application; with advanced matching, the email address and phone number entered at sign-up, hashed in the browser | United States | EU-U.S. Data Privacy Framework / SCCs per Meta's data terms |
| LinkedIn Corporation — Insight Tag | Advertising measurement, retargeting and website analytics for LinkedIn campaigns | Cookie identifiers, device, page and event data on diallink.com and the sign-up and onboarding pages of the web application | United States | SCCs / EU-U.S. Data Privacy Framework per LinkedIn's data terms |
| CookieYes Limited | Cookie consent management (consent banner and Google Consent Mode signals) | Consent choices, anonymized identifiers | United Kingdom | UK Addendum / SCCs per CookieYes's data terms |
| Intercom, Inc. | Support and sales chat, help center, onboarding and product messages | Contact details and conversation content | United States | Data Privacy Framework / SCCs per Intercom's data terms |
| PostHog, Inc. | Product analytics and session replay on the sign-in page, the sign-up and onboarding screens and the partner payment-setup page only — not inside the signed-in apps | Pages viewed and actions taken on those screens, device, browser and operating-system information, IP address, the sign-up email address and company name once entered; session replays of those screens with typed input masked on the device, passwords never captured, card fields not visible (Stripe frame). Replays retained 90 days; events up to 7 years | United States (PostHog US Cloud, hosted on Amazon Web Services) | DPA with SCCs (posthog.com/dpa) |
| Vercel, Inc. | Hosting and deployment of the front end of our web applications | Request logs (IP address, page requested, browser) where enabled | United States | DPA per Vercel's terms; request logs kept up to 30 days |
| Expo (650 Industries, Inc.) | Build service and over-the-air updates for the mobile apps | From devices that check for an update: operating system, a random per-installation token, app and update identifiers and IP address — no names, email addresses or account identifiers | United States | Expo's terms and privacy policy |
| VerifyMail.io | Email address verification at sign-up (blocks disposable and temporary email domains) | The email address entered at sign-up | United States (as stated by the vendor) | Vendor terms and privacy policy |
| Twilio Inc. (Programmable Messaging, Lookup and Verify) | Phone verification at sign-up (text-message code and line-type check) and sign-in verification codes | Mobile number entered at sign-up or on the Account, line type, the verification code message | United States | DPA with SCCs; message logs 13 months |
| APILayer Data Products GmbH / Idera, Inc. (ipstack) | IP geolocation and proxy, Tor and threat check at sign-up and when verification codes are requested (fraud prevention) | IP address | United States (as stated by the vendor) | Vendor terms and privacy policy |
| TeleDynamics (James and Judy Feller DBA TeleDynamics) | Fulfilment of desk phones and accessories you order from us | Business name, contact name, shipping address and phone number for hardware orders; device serial numbers and MAC addresses | United States | Supplier terms; data used only to fulfil the order |
| Authorized sales partners (currently Infinity Sales Group, LLC, Boca Raton, Florida) | Taking orders by telephone and assisting with onboarding for the customers they introduce; commission reporting | Business and contact details, plan, activation status and recurring charges of the customers they introduce | United States | Services agreement with confidentiality and U.S. state privacy-law obligations |
| The Commpliance Group, Inc. | Regulatory filings (FCC and state) and tax compliance support | Aggregate revenue, traffic and tax data; no customer personal data | United States | Engagement agreement with confidentiality obligations |
| Rippling People Center Inc. | Human resources and payroll for our staff | Staff data only | United States | Rippling's data terms (no customer data) |
C. Integrations you connect yourself (not sub-processors)
When you connect a third-party service to your Account, data flows to that service at your direction and under your agreement with its provider. These providers are not our sub-processors; see Section 17 of the Privacy Policy and Section 5.6 of the AI Features Terms. Integrations available today:
- Phone-system integrations: HubSpot (logs calls and messages, syncs contacts); Salesforce (a task per call with the recording link, summary and transcript; contact create, update and delete); Microsoft Teams (a bot that posts call notifications, delivered through Microsoft's Bot Framework service); Slack (call and message notifications); Zapier (triggers for calls, messages, voicemails and contacts); Google (Contacts sync, Calendar availability, and Gmail read and compose access where you grant it); Microsoft 365 (Outlook contacts sync through Microsoft Graph).
- Tools your AI Agents can use: Cal.com, Calendly, Xero, Shopify, Atlassian, Asana, Intercom, Zapier, HubSpot, Slack, Google Calendar and Gmail. Every tool exposed by the service is available to the AI Agent unless you block it in the agent's settings; we hold the connection credentials you supply.
- AI assistants: ChatGPT (OpenAI), Claude (Anthropic), Grok (xAI) or any other assistant that supports remote MCP connectors, through the DialLink MCP Server for AI Assistants.
Change history
| Date | Change |
|---|---|
| November 2, 2026 | Version 2.0: complete rebuild of the list; AI model and voice providers (OpenAI, xAI, Anthropic, ElevenLabs), WhatsApp Business Platform (Meta, through Twilio), spam scoring, knowledge-base retrieval, push-notification, reporting, payment, tax, CRM, server-side tracking, session-replay analytics, support, monitoring, verification, hosting, hardware-fulfilment and engineering providers added; Section C (integrations you connect) added; FullContact removed. |