Sub-processors and Data Location
Last updated: 9 October 2026 · Version: 1.0
This page is part of the Ethos Privacy Policy and Terms of Use. It names every company that receives any part of your data, what it receives, why, where it is, and what that company's own published terms say about training, retention and location. We update it before a new company receives any personal data.
How to read the two columns on the right. "What we send, and when" is our commitment, verified against our own code. "Their published terms" is what the company's own legal documents said when we last checked, with the date. We show both so that you can see our claims and theirs side by side, and so that we never assert a term on another company's behalf that we cannot show.
1. Where Ethos runs
| What | Where | Provider |
|---|---|---|
| Our servers, our database and every file you upload | United States (California) | Railway |
| Our own operations system, which receives content-free product events | United States (California) | Railway |
| The earlier web version of the Service, which is being retired: its servers | Netherlands (Amsterdam) | Railway |
| The earlier web version: its database | Germany (Frankfurt) | Supabase |
| The website at ethosy.ai | Served from locations near the visitor; built and hosted by Vercel | Vercel |
Backups of our database and files are taken on a fixed schedule and each is kept for a fixed period: a daily backup for 6 days, a weekly backup for 27 days, and a monthly backup for 89 days, depending on which schedules are enabled. Backups are never read to answer anyone.
2. Companies that receive your data today
| Company | What we send, and when | Why | Where they process it | Their published terms, and when we checked |
|---|---|---|---|---|
| Clerk (Clerk, Inc.) | Your email address and sign-in identity; the record that you accepted the Terms and Privacy Policy. Deleted by our instruction when you delete your Account. | Sign-in, so that only you can reach your Archive | United States, on Google Cloud and Cloudflare infrastructure | Data-processing addendum incorporated into its terms, with EU Standard Contractual Clauses and the UK Addendum; self-certified under the EU-US Data Privacy Framework. No statement of training on customer data. Checked 23 September 2026. |
| Railway (Railway Corp.) | Everything: our servers, database and uploaded files run there. | Hosting | United States (California) for the product and our operations system; Netherlands for the earlier web version | Data-processing addendum with EU Standard Contractual Clauses and the UK Addendum; self-certified under the EU-US Data Privacy Framework. Volume backups: daily kept 6 days, weekly 27 days, monthly 89 days. Checked 23 September 2026. |
| OpenAI (OpenAI, L.L.C.) | The text of Source Material, including the other side of imported conversations, documents and approved pages, when passages are extracted and the description of the Subject is compiled. Your message and the passages that answer it, when a reply is written. The text of passages, when the index is built. A recording, when it is transcribed. Your speech during a call on our own lane, streamed for transcription. | Extracting and indexing the Archive, writing replies, and turning speech into text | United States | API data is not used to train OpenAI's models unless the customer opts in, and we have not. Inputs and outputs are retained for up to 30 days for abuse monitoring; audio sent for transcription is not retained. Data-processing addendum available. Checked 23 September 2026. |
| ElevenLabs (Eleven Labs, Inc.) | The recordings you add as the Subject's own voice, and the Subject's name as the name of the voice, to build a Voice Model. The text of a reply, when it is spoken aloud. On the call lane that uses ElevenLabs' conversational agent: your speech during the call, and either only the sentences our own server decides to speak, or, for an agent built with a knowledge base, the compiled description of the Subject and the facts in the Archive, with replies written by a model ElevenLabs hosts (Google Gemini). The only agent that exists today belongs to the operator's own Archive; agents for users' Archives will be built so that ElevenLabs receives only the sentences our server decides to speak, and this page will say so before any user's Archive is on that lane. The Voice Model is deleted by our instruction when you delete the recording it was built from, the Archive or your Account (Privacy Policy section 5.4 describes a Voice Model built before we recorded which recording it came from); the agent, when you delete the Archive or your Account. | Building a voice, and speaking replies aloud | United States, Netherlands and Singapore | Data-processing addendum incorporated into its terms, with EU Standard Contractual Clauses and the EU-US Data Privacy Framework. Its privacy policy states that data may be used to improve its models unless the account opts out; our account is set to opt out. Voice-related data it holds is retained for no longer than three years after the last interaction; conversational-agent data for up to two years unless zero-retention mode is enabled, which we enable. We are seeking written confirmation that deleting a voice also deletes the recordings it was built from, and will update this page when we have it. Checked 23 September 2026. |
| Anam (Anam AI Ltd) | The most recent photograph of the Subject, once, when you first start a video call on the Anam lane; with each call, the Subject's name and each reply as spoken audio. The face Anam builds is kept by Anam and deleted by our instruction when you delete the Archive or your Account. | Animating a face during a video call | European Union and United States | Terms state that customer content is not used to train its models. Call-session data is retained for up to 30 days unless zero-data retention is agreed; transcripts and summaries until deleted. Data-processing addendum with a UK transfer addendum. Checked 23 September 2026. |
| LemonSlice (Infinity AI, Inc., doing business as Lemon Slice) | The photograph of the Subject you chose, after the voice-and-face consent, at the first meeting with the Subject straight after the Archive is made and at each video call on the LemonSlice lane; with each meeting or call, each reply as spoken audio. The face is drawn from the photograph for that session; nothing from your Archive beyond the photograph and the replies being spoken. | Drawing and animating a face during the first meeting and video calls | United States | Its privacy policy states that its services are hosted in the United States and that transfers from the EEA and UK rely on Standard Contractual Clauses. It does not state a retention period for submitted images or audio, or whether they are used to train its models; we are asking LemonSlice in writing and will update this page when we have the answer. Checked 9 October 2026. |
| LiveKit (LiveKit Incorporated) | The sound and picture of a meeting or video call on the LemonSlice lane while it runs: your speech, the animated face, and the replies being spoken. | Carrying the call between your phone, our call worker and the animation service | United States | States that it does not use customer content, transcripts or audio to train its models. Self-certified under the EU-US Data Privacy Framework. Data-processing addendum available. It does not state that room media is recorded, and we do not ask it to record. Checked 9 October 2026. |
| Bright Data (Bright Data Ltd.) | A public web address you approved, other than Wikipedia, when you ask the Service to find public material about the Subject. Nothing from your Archive. | Fetching public pages on our behalf so that our servers never open a user-typed address | Israel and the United States | A fetching service; it receives the address, not your Archive. Checked 23 September 2026. |
| Wikimedia Foundation | A name you search for, to find matching Wikipedia articles; and the title or address of an article you add or approve. | Searching and fetching Wikipedia | United States | Wikipedia text is licensed under Creative Commons Attribution-ShareAlike. Checked 23 September 2026. |
| PostHog (PostHog, Inc.) | From the App and our servers: content-free usage events, meaning screen names, counts, stage labels and true-or-false values, with an Account identifier; never message content, names, files or recordings. From the Website: page views, the addresses of pages you visit and interactions such as clicks. | Understanding which parts of the Service are used | European Union (Germany) | Its privacy policy states that anonymised data may be used to improve its products unless the account opts out; our account is set to opt out. Data-processing addendum available. Checked 23 September 2026. |
| Sentry (Functional Software, Inc.) | Crash reports. From the App: the error, the screen it happened on, and the device model and system version, with no message content and no personal identifiers. From our servers: the error and a short trail of recent log lines, which can include names mentioned in an Archive. | Finding and fixing faults | European Union (Germany) for the App's reports | Data-processing addendum with EU Standard Contractual Clauses and the UK Addendum; processes personal data only on our instructions and does not sell or share it. Checked 9 October 2026. |
| RevenueCat (RevenueCat, Inc.) | When you buy or restore the plan: your Account identifier and the purchase record the App Store or Google Play reports (the receipt or purchase token), with the device type and system version. Never your card details, which only the store sees. | Knowing whether your Account holds the plan | United States | Acts as a processor for us. Data-processing addendum available. States that end-user data is used only to provide its service. Checked 9 October 2026. |
| Google (Google LLC) | When you sign in with Google: the identity Google gives us (an identifier, your email address, and your name if you allow it). When you install the App from Google Play: whatever Google Play collects under its own terms. | Sign-in; distribution of the App | United States | Google's own privacy policy governs what it collects from you. Checked 23 September 2026. |
| Apple (Apple Inc.) | When you sign in with Apple, where offered: the identity Apple gives us (an identifier, your email address or a private relay address, and your name on first sign-in). When you install the App from the App Store: whatever the App Store collects under its own terms. | Sign-in; distribution of the App | United States | Apple's own privacy policy governs what it collects from you. Checked 23 September 2026. |
| Vercel (Vercel Inc.) | Requests to the Website, including your IP address, and the Website's server logs. | Hosting the Website | United States, with edge locations worldwide | Data-processing addendum with EU Standard Contractual Clauses and the UK Addendum. Checked 23 September 2026. |
Companies that host or generate content receive only the part named in their row, at the moment something is being done with it. None of them is given an Archive to browse, with the one exception stated plainly in the ElevenLabs row for an agent built with a knowledge base.
3. Networks that serve the video-call page
The page that shows a video call on a vendor's lane loads its code and fonts from these networks. They see your IP address when the page loads and receive nothing else.
| Network | What it serves | Where |
|---|---|---|
| esm.sh | The page's JavaScript modules | Worldwide content-delivery network |
| Google Fonts (Google LLC) | The page's fonts | Worldwide content-delivery network |
4. The earlier web version
An earlier, web-based version of the Service can still be reached from the Website after sign-in and is being retired. If you sign in on the Website, your email address and name are recorded in its database as well. Its data is handled by:
| Company | What it holds or receives | Where |
|---|---|---|
| Railway | Its servers, which also fetch web addresses pasted there | Netherlands (Amsterdam) |
| Supabase (Supabase, Inc.) | Its database: accounts, Archives built there, invitations and access grants | Germany (Frankfurt) |
| An S3-compatible storage bucket | Files uploaded there | As configured for that version |
| Clerk | Sign-in, as for the App | United States |
| Postmark (ActiveCampaign, LLC) | Emails it sends, such as invitations | United States |
| Anthropic | Writes that version's replies | United States |
| OpenAI | Extracts passages, reads text from images, and transcribes speech for that version | United States |
| ElevenLabs, Anam | Voices and faces, as for the App | As in section 2 |
| Sentry | Crash reports, which is enabled for that version | United States or European Union, as configured |
| D-ID, Deepgram | Face animation and transcription, only if configured for that version | United States |
Deleting your Account in the App does not reach this version. Write to privacy@ethosy.ai and we will delete what it holds about you.
5. Integrated but not active
The following are wired into the App's backend but receive nothing from users' Archives today, either because the setting that would enable them is not on, or because they can be reached only from our test builds and the operator's own test Archives. We will move any of them into section 2, and notify you in the App, before it receives personal data.
| Company | What it would receive | Why it exists in our code | Status |
|---|---|---|---|
| Anthropic (Anthropic, PBC) | The same message and passages OpenAI receives, to write a reply | An alternative language-model provider | Not active: OpenAI is the provider in use |
| Google Gemini (Google LLC) | The same message and passages, to write a reply | An alternative language-model provider | Not active as our provider; see the ElevenLabs row for its use inside an ElevenLabs agent |
| Hume AI (Hume AI, Inc.) | Your speech during a call on the Hume lane | An alternative call lane | Not active for users' Archives: the lane can be chosen only in our test builds, not in the App from the stores |
| bitHuman (bitHuman, Inc.) | A video-call session on the bitHuman lane, carried by LiveKit | An alternative video lane | Not active for users' Archives: the lane can be chosen only in our test builds, and its faces exist only for the operator's own test Archives |
| Spatius (SpatialWalk Pte. Ltd.) | A video-call session on the Spatius lane, carried by LiveKit | An alternative video lane | Not active for users' Archives: the lane can be chosen only in our test builds, and its faces exist only for the operator's own test Archives |
| TypeSafe (TypeSafe AI) | The text of a reply and the passages behind it, after the reply, for a grounding audit | Auditing that replies were grounded in the Archive | Not active for any user's Archive, and will not be until this page says so |
| D-ID (D-ID Ltd) | A photograph | Offline authoring tooling for the App; see section 4 for the earlier web version | Not active for the App |
6. Change history
| Version | Date | Change |
|---|---|---|
| 1.0 | 9 October 2026 | First publication of this page. Replaces the processor table that previously appeared inside the Privacy Policy: corrects the language-model provider from Anthropic to OpenAI, states what OpenAI receives during extraction, describes the ElevenLabs agent lane, adds Wikimedia, Google, Apple and Vercel, names the content-delivery networks and the earlier web version's stack, states each company's location, and lists integrated-but-inactive vendors separately. Before first publication (9 October 2026): adds LemonSlice, LiveKit, Sentry and RevenueCat to section 2, now that the first meeting, crash reports and the plan are live, and says which lanes reach only test builds. |