Andy

Legal

Sub-processors

Last updated: 24 September 2026

Andesphere uses the providers below to run Andy Partner for all customers: Andesphere Ltd for customers outside Chile, and Andesphere SpA for customers in Chile.

Customers who use Andy are the controllers of their end customers' data, and we process that data for them. The providers in section 1 help us do that. They are our sub-processors. Customers of Andesphere Ltd get 30 days' notice before we add or replace one, as the Data Processing Agreement says.

Where our configuration fixes the region, we name it. Otherwise the provider chooses where it processes data. Most of these providers are US companies.

1. Sub-processors

Core platform

  • Convex, Inc. Application database, backend functions and file storage. Receives all service data: account holders, workspaces, agents, knowledge, conversations, messages, contacts, leads and voice recordings. Region: United States.
  • Vercel Inc. (hosting). Hosts the website, the web app and the API routes that receive chat, widget and webhook traffic. Receives everything that passes through the app and API in transit, including end-customer messages and visitor IP addresses.
  • Vercel Inc. (AI Gateway). Routes AI requests to the model providers below. Receives prompts: end-customer messages, conversation history, business knowledge and agent instructions, tagged with the workspace and agent IDs.
  • Clerk, Inc. Sign-in and account authentication. Receives account holder name, email, sign-in identifiers, session and device data.
  • Upstash, Inc. Cache for subscription status. Receives account identifiers and cached plan entitlements.

AI model providers (reached through the Vercel AI Gateway)

  • Google (Gemini). Default model for agent replies, PDF text extraction, summaries and marketing image generation. Receives end-customer messages and context, and uploaded documents.
  • OpenAI. Optional reply models, conversation insights, embeddings for knowledge search, voice-note transcription, language detection and website summaries. Receives end-customer messages and voice notes, and knowledge content.
  • Anthropic. Optional reply models, and marketing content planning and drafting. Receives end-customer messages and context when a customer selects one of its models, and business marketing content.
  • xAI. Cleaning of imported knowledge content, and optional reply models. Receives knowledge content, and end-customer messages when a customer selects one of its models.
  • DeepSeek model. Writes a short title for each conversation. Receives conversation excerpts.
  • Moonshot AI (Kimi), MiniMax and Z.ai (GLM) models. Optional reply models that a customer can choose for an agent. Receive end-customer messages and context, only if the customer selects one.

We call the DeepSeek, Moonshot AI, MiniMax and Z.ai models by name through the Vercel AI Gateway, which decides which inference provider runs each request.

Messaging, voice and integrations operated by Andy

  • Railway Corp. Hosts the bridge for the unofficial WhatsApp Direct connection, with its database and cache. Receives WhatsApp session keys (encrypted), messages waiting for delivery (encrypted, deleted after delivery) and phone numbers. Region: Netherlands (EU).
  • Composio. Connection broker for Google Calendar and Google Drive. Receives Google OAuth tokens, calendar events (appointment details, which can include end-customer names and contact details) and Drive files chosen for knowledge.
  • ElevenLabs. Voice agent calls, when a customer uses the voice channel. Receives call audio and transcripts.
  • Firecrawl. Reads the customer's website to build agent knowledge. Receives public website content, which can include names or contact details.
  • ip-api.com. Looks up the approximate location of website chat visitors. Receives the visitor's IP address.

Email, notifications, payments and monitoring

  • Resend. Emails to account holders: service notices, lead, booking and handoff alerts, lifecycle and product emails. Receives account holder email and name. Lead, booking and handoff alerts include the end customer's name, contact details and a summary of the request.
  • Expo (650 Industries). Delivers mobile push notifications through Apple and Google push services. Receives the device push token and a generic notice text, with no message content.
  • Stripe. Subscription billing and payments. Receives account holder name, email, billing details and payment method, which Stripe collects.
  • PostHog, Inc. Product analytics for the website, web app and mobile app. Receives usage events, device and browser data, account ID and email for signed-in users, and masked session recordings from the web app. Region: United States.
  • Functional Software, Inc. (Sentry). Error monitoring. Receives error details, device and browser data, and masked session replays for sessions that hit an error.

2. Services the customer connects and contracts with directly

These providers carry messages or data because the customer connects its own account. The customer has its own agreement with them. We list them for transparency.

  • Meta Platforms (Official WhatsApp by Meta, Instagram messaging, Instagram publishing).
  • Google (the customer's own Google Calendar and Google Drive).
  • Slack (when the customer connects a Slack channel).
  • X, LinkedIn and TikTok (when the customer publishes marketing posts).
  • Bsale (customers in Chile only).

3. Andesphere's own tools (no end-customer data)

  • Andesphere internal sales CRM. Receives account holders' signup details (name and email), first payment events and messages sent to Andy's own contact form. Signals that carry end-customer content (conversation excerpts, leads, bookings) are sent only for Andesphere's own workspace.
  • Sales outreach tools (Serper, Hunter, ZeroBounce, TwitterAPI.io, Firecrawl and a Z.ai model). Andesphere uses these only for its own sales outreach, and they are locked to the Andesphere workspace. They never receive customer data.

4. Changes

We update this page and the date at the top when the list changes.