Sub-processors
Last updated: 2026-08-07 · Version 0.1 · Status: Draft for legal review — not yet in force
The third parties that receive personal information in order to make the service work, and what each one gets. Compiled from the code that sends it, so this list is what actually happens rather than what was intended.
Not every business uses every one. A business on one telephony
stack does not touch the other. The chat assistant is a separate product; a
business that only answers phones never reaches the providers listed under it.
Answering the phone
| Provider | What it receives | Why |
|---|---|---|
| Twilio | Caller phone number, call audio, and call metadata. Where a business has recording switched on, Twilio holds the recording. Also SMS content and recipient numbers, where a business has SMS summaries enabled. | Carries the call, and sends text-message summaries. |
| VAPI | Call audio and the transcript, plus the assistant's configured prompt and the business's saved information. | Runs the voice assistant, for businesses on that stack. |
| OpenAI | Call audio, via a direct SIP connection, and the transcript. | Runs the voice assistant for businesses on the newer stack, and transcribes and summarises calls. |
The chat assistant
| Provider | What it receives | Why |
|---|---|---|
| Microsoft Azure | Hosts the dedicated machine on which each customer's chat assistant runs, and therefore holds that assistant's conversations and its memory. Located in [AZURE REGION AS DEPLOYED — currently East US]. | Runs the assistant. |
| Azure OpenAI | The text of chat messages, and the business information the assistant has been given. | Generates the assistant's replies. |
| OpenAI | The contents of files a member of staff attaches — the text extracted from a PDF or Word document, an image, or an audio recording. | Describes attached images and transcribes attached audio. |
Review note — remove before publishing. Azure region is East US today, so customer chat data currently
leaves Canada. If any customer expects Canadian data residency, that is a
contract problem before it is a technical one — Canada Central is available and
was costed at roughly 10% more. Decide, then state it here without a placeholder.
Everything else
| Provider | What it receives | Why |
|---|---|---|
| [EMAIL PROVIDER] | Recipient addresses and the content of summary and notification emails, which include call summaries. | Delivers email. |
| [HOSTING PROVIDER FOR THE APPLICATION AND DATABASE] | Everything stored by the application. | Runs the application and its database. |
Changes to this list
[NOTICE PERIOD FOR ADDING A SUB-PROCESSOR] We will publish changes here, with the date, before a new provider begins processing.
Review note — remove before publishing. A dated changelog is normally expected on this page, and enterprise
customers often require advance notice and a right to object. Neither exists
yet.
Questions about any provider on this list: info@moneliautomation.com.
This is not legal advice. This document was drafted from
what the software actually does, by the people who built it, and it has not
been reviewed by a lawyer. It must be reviewed by Canadian privacy counsel
— and, where a customer is a health information custodian or a law firm, by
counsel familiar with PHIPA, the Alberta Health Information Act,
Quebec's Law 25 and professional obligations of confidentiality — before it
is published or relied on by anyone. Highlighted
[LIKE THIS] are facts we have deliberately not
invented; they must be filled in before publication.