Service Providers
Last updated 4 November 2026
This page lists every service that processes personal data for the HeadOS app. Retention periods are in section 10 of the Privacy Policy. Prompts and generated text contain personal information even when no name or email field is sent.
Supabase (Supabase Pte. Ltd, Singapore)
Purpose: sign-in, database, file storage and backend functions. Data: account details, setup answers, transcripts, Captures, photos, generated memory, usage records. Location: database and storage in Ireland (eu-west-1). Transfer safeguard: Standard Contractual Clauses for support and operations outside the EEA. Agreement: https://supabase.com/legal/customer-resources/data-processing-addendum
Cloudflare (Cloudflare, Inc.)
Purpose: runs the voice agent for calls. It keeps each call's state in a Durable Object and a session report in the D1 database “heados-agent-analytics”. Data: session IDs, the conversation so far, saved context used for the call, the call transcript, timings, token volumes and costs. Location: global Cloudflare network, not restricted to the EU. Transfer safeguard: Standard Contractual Clauses. Agreement: https://www.cloudflare.com/cloudflare-customer-dpa/
LiveKit (LiveKit Incorporated)
Purpose: real-time audio between your iPhone and the voice agent. Data: live audio, connection metadata. LiveKit does not record calls for us. Location: project data region European Union (Frankfurt). Real-time traffic can use LiveKit's global network. Transfer safeguard: Standard Contractual Clauses. Agreement: https://livekit.com/legal/data-processing-addendum
Soniox (Soniox Inc.)
Purpose: speech recognition for conversations, Captures and voice feedback. Data: audio, resulting transcripts, technical request data. Location: United States. Transfer safeguard: Standard Contractual Clauses. Agreement: DPA version 1.3, signed in the Soniox Console on 31 October 2026. Policies: https://soniox.com/policies
Anthropic (Anthropic Ireland, Limited)
Purpose: Claude Haiku writes Cleo's replies, analyses conversations and Captures, and supports Goals. Data: prompts, conversation and Capture text, saved memory, generated results. Location: United States, global routing. Transfer safeguard: Standard Contractual Clauses. Agreement: https://www.anthropic.com/legal/data-processing-addendum Retention: https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data
OpenAI (OpenAI Ireland Ltd)
Purpose: text embeddings for search, through the API. OpenAI does not generate Cleo's replies or analyses. Data: text from conversations, Captures, profile items and People notes. Location: global. Transfer safeguard: Standard Contractual Clauses. Agreement: https://openai.com/policies/data-processing-addendum/ Data controls: https://developers.openai.com/api/docs/guides/your-data
ElevenLabs (Eleven Labs Inc.)
Purpose: Cleo's spoken voice. Data: the text to be spoken, generated audio, technical request data. Location: United States. Transfer safeguard: EU–US Data Privacy Framework where applicable, otherwise Standard Contractual Clauses. Agreement: https://elevenlabs.io/dpa
LangSmith (LangChain, Inc.)
Purpose: full diagnostic records of conversations and analyses, and evaluation. Data: complete prompts, saved memory, transcripts, replies, analysis results, identifiers, errors, timings and usage. Location: LangSmith EU service. Transfer safeguard: Standard Contractual Clauses for support and operations outside the EEA. Agreement: https://www.langchain.com/dpa Retention: https://docs.langchain.com/langsmith/data-purging-compliance
Resend (Plus Five Five, Inc.)
Purpose: sending verification, sign-in and security emails, and your beta confirmation. Data: recipient address, first name, message content including verification codes, delivery records. Location: United States. Transfer safeguard: Standard Contractual Clauses. Agreement: https://resend.com/legal/dpa
IONOS (IONOS SE)
Purpose: our mailboxes and domain. Data: sender details, messages, attachments and mail metadata. Location: Germany. Agreement: https://www.ionos.de/hilfe/datenschutz/allgemeine-informationen-zur-datenschutz-grundverordnung-dsgvo/vereinbarung-zur-auftragsverarbeitung-avv-mit-ionos-abschliessen/
Apple
Purpose: app distribution, TestFlight, push notifications and iOS. Apple acts under its own terms, not as our processor. A file location you select in iCloud Drive or another storage app is your own arrangement with that provider. Privacy information: https://www.apple.com/legal/privacy/
Providers use sub-processors of their own. Each provider's agreement or website lists them.
Questions about recipients, transfers or deletion: privacy@heados.app.