1.What this list covers
A subprocessor is a service provider that processes data for JULY Call, including the personal information of our customers’ callers and contacts. Our Data Processing Addendum authorizes the providers below. Each is bound by contract to protect the data it handles and to use it only to provide its service. Our records are stored in Canada; calls, texts and email are processed in the United States, and the last column says what each provider keeps on its side, and for how long.
2.Providers we always use
- ProviderSupabaseWhat it doesDatabase, sign-in (authentication) and file storage, including call recordings after the callWhereCanada (AWS ca-central-1)What it keepsOur records while the account is open; daily backups for 7 days
- ProviderVercelWhat it doesHosting of the web app, API and scheduled jobsWhereCanada (Montréal) for computing; United States for builds, logs and the content delivery networkWhat it keepsApplication logs, which can include phone numbers and parts of messages, for up to 30 days
- ProviderRailwayWhat it doesThe voice relay that handles live callsWhereUnited StatesWhat it keepsRelay logs, which can include phone numbers and parts of what was said, for up to 30 days
- ProviderTwilioWhat it doesPhone numbers, calls, texts and WhatsApp delivery; recording during the call (recordings are removed from Twilio once copied to Canada); live speech-to-text and text-to-speech, by Deepgram and ElevenLabs as Twilio’s providers inside its serviceWhereUnited StatesWhat it keepsRecords of calls and texts (numbers, times, durations, the words of texts) until the business’s retention period ends, when we delete them there
- ProviderAnthropicWhat it doesAI language processing (Claude) for each turn of a call, texts, emails, setup drafts and outreach messages; under its commercial terms, customer content is not used to train its modelsWhereUnited StatesWhat it keepsWhat it processes, for up to 30 days, unless it must keep it longer to enforce its usage policy or to comply with the law
- ProviderJULY Send (operated by JULY Software Inc., a JULY group company)What it doesTransactional and outreach email, sent through Amazon SESWhereUnited States (Amazon SES, us-east-1)What it keepsA delivery record of each email (recipient, subject, delivery status) for up to 24 months; bounced and complaining addresses as long as needed
- ProviderHelcimWhat it doesCard payments for JULY Call subscriptions, invoices and Wallet top-upsWhereCanadaWhat it keepsPayment records, as payment-card and tax rules require
| Provider | What it does | Where | What it keeps |
|---|---|---|---|
| Supabase | Database, sign-in (authentication) and file storage, including call recordings after the call | Canada (AWS ca-central-1) | Our records while the account is open; daily backups for 7 days |
| Vercel | Hosting of the web app, API and scheduled jobs | Canada (Montréal) for computing; United States for builds, logs and the content delivery network | Application logs, which can include phone numbers and parts of messages, for up to 30 days |
| Railway | The voice relay that handles live calls | United States | Relay logs, which can include phone numbers and parts of what was said, for up to 30 days |
| Twilio | Phone numbers, calls, texts and WhatsApp delivery; recording during the call (recordings are removed from Twilio once copied to Canada); live speech-to-text and text-to-speech, by Deepgram and ElevenLabs as Twilio’s providers inside its service | United States | Records of calls and texts (numbers, times, durations, the words of texts) until the business’s retention period ends, when we delete them there |
| Anthropic | AI language processing (Claude) for each turn of a call, texts, emails, setup drafts and outreach messages; under its commercial terms, customer content is not used to train its models | United States | What it processes, for up to 30 days, unless it must keep it longer to enforce its usage policy or to comply with the law |
| JULY Send (operated by JULY Software Inc., a JULY group company) | Transactional and outreach email, sent through Amazon SES | United States (Amazon SES, us-east-1) | A delivery record of each email (recipient, subject, delivery status) for up to 24 months; bounced and complaining addresses as long as needed |
| Helcim | Card payments for JULY Call subscriptions, invoices and Wallet top-ups | Canada | Payment records, as payment-card and tax rules require |
3.Providers used only when a feature is on
- ProviderBrevoWhat it doesFallback email provider, used only when JULY Send cannot sendWhereEuropean UnionWhat it keepsIts sending logs for an email it sent, for a limited time under its terms
- ProviderGoogleWhat it doesSign in with Google, Google Calendar and Google MeetWhereUnited States / globalWhat it keepsCalendar events in the connected calendar, under Google’s terms
- ProviderMetaWhat it doesWhatsApp messaging, through Twilio, for a business whose WhatsApp sender is approvedWhereGlobalWhat it keepsWhatsApp messages, under Meta’s terms
- ProviderSignWellWhat it doesElectronic signatures for documents a business sends for signing (the document tools), only if the business uses themWhereUnited StatesWhat it keepsThe documents sent for signing, under SignWell’s terms
| Provider | What it does | Where | What it keeps |
|---|---|---|---|
| Brevo | Fallback email provider, used only when JULY Send cannot send | European Union | Its sending logs for an email it sent, for a limited time under its terms |
| Sign in with Google, Google Calendar and Google Meet | United States / global | Calendar events in the connected calendar, under Google’s terms | |
| Meta | WhatsApp messaging, through Twilio, for a business whose WhatsApp sender is approved | Global | WhatsApp messages, under Meta’s terms |
| SignWell | Electronic signatures for documents a business sends for signing (the document tools), only if the business uses them | United States | The documents sent for signing, under SignWell’s terms |
4.Accounts a business connects
When a business connects an account it holds with a provider (its Google account for Google Calendar, or its Facebook page for lead forms), that provider also acts for the business under the business’s own agreement with it.
5.How we announce changes
We update this page before a new subprocessor starts processing our customers’ personal information, and we email account owners at least 15 days in advance, unless we must act sooner to keep the service running or secure; then we tell them as soon as we reasonably can. A customer may object as the Data Processing Addendum describes. The effective date at the top of this page shows when the list last changed.
6.Questions
Questions about our subprocessors: support@july.ca.