Subprocessors
The third parties Zobi uses to process personal data on behalf of merchants.
Our subprocessors
Zobi, operated by Zobi OÜ (an Estonian private limited company, osaühing), uses the third parties listed below to process personal data on behalf of merchants when providing the service. This list forms part of our data processing addendum. For more on how we handle personal data, see our privacy policy.
| Subprocessor | Purpose | Processing location |
|---|---|---|
| DigitalOcean | Cloud hosting, managed databases and object storage (DigitalOcean Spaces) | European Union (Amsterdam) and United States (New York) (EU Standard Contractual Clauses) |
| Railway | Hosting for the Recoup Shopify connector and its database | United States (EU Standard Contractual Clauses) |
| Cloudflare | Content delivery, DNS, network security, and object storage for analytics and backups (Cloudflare R2) | United States and global (EU Standard Contractual Clauses) |
| Stripe | Payment and billing processing | United States and EU (Stripe Payments Europe, Ireland) |
| Basis Theory | Secure storage of payment cards saved on a checkout page Zobi hosts for the merchant, and sending them to the merchant’s payment processor or order system when a charge is made | United States |
| Anthropic | AI generation of message content (Claude models) | United States (EU Standard Contractual Clauses) |
| OpenRouter | Routing of AI requests to model providers, used as a fallback for message generation and for voice transcription, with zero data retention required on every request | United States (EU Standard Contractual Clauses) |
| AI models reached through OpenRouter, used for message review and voice transcription | United States and global (EU Standard Contractual Clauses) | |
| ElevenLabs | Text-to-speech for voice messages | United States (EU Standard Contractual Clauses) |
| Langfuse | Monitoring of AI requests and responses | United States (EU Standard Contractual Clauses) |
| Blooio | iMessage and RCS message delivery | Outside the EEA (EU Standard Contractual Clauses) |
| SendBlue | iMessage message delivery | United States (EU Standard Contractual Clauses) |
| AgentPhone | iMessage and SMS message delivery | Outside the EEA (EU Standard Contractual Clauses) |
| Twilio | SMS message delivery, voice calls, and phone number lookups | United States (EU Standard Contractual Clauses) |
| Photon | iMessage message delivery and voice calls | Outside the EEA (EU Standard Contractual Clauses) |
| Bird | SMS message delivery | European Union and outside the EEA (EU Standard Contractual Clauses) |
| TCPA Litigator List | Checking phone numbers against known litigator and do-not-call lists before messaging | United States (EU Standard Contractual Clauses) |
| Resend | Transactional and notification email delivery | United States (EU Standard Contractual Clauses) |
| Shopify | E-commerce platform integration (store and customer data) | Canada, United States, EU, and global |
Changes to this list
We may add, remove, or replace subprocessors at any time as the service evolves. When we do, we update this page. For material changes that affect the processing of a controller’s personal data, we give notice as described in our data processing addendum. Your continued use of the service after we post an update constitutes acceptance of the updated list.
A controller may object to a new subprocessor on reasonable, documented data-protection grounds, following the process in the data processing addendum. If we cannot reasonably resolve the objection, the controller’s sole and exclusive remedy is to terminate the affected part of the service, as set out in the data processing addendum.
To be notified of updates, email [email protected] to request notice.
Liability and international transfers
We remain responsible for our subprocessors only to the extent required by Article 28(4) of the EU General Data Protection Regulation (GDPR), and not further. Where a subprocessor fails to meet its data-protection obligations, our liability is limited as set out in the data processing addendum and the terms of service.
Where personal data is transferred to a subprocessor outside the European Economic Area, those transfers rely on the European Commission’s Standard Contractual Clauses or another lawful transfer mechanism, together with any supplementary measures required. Nothing on this page excludes or limits liability that cannot be excluded or limited under the laws of the Republic of Estonia or under mandatory provisions of European Union law, including the GDPR.
Contact
Questions about our subprocessors? Email us at [email protected].
This document is provided for general information and does not constitute legal advice. If you have questions about it, contact us at [email protected].