Draft — pending legal review
This document is a working draft and has not yet been approved by a lawyer. Text in [square brackets] is still to be confirmed.
Sub-processors
The third-party services Ventriqa uses to run the platform, what data they receive and where they are.
Effective date: [Effective date] · Last updated: [Last updated date]
To run Ventriqa we use other companies for things like hosting, AI, phone calls and payments. When they handle personal data for us, they are our "sub-processors". This page lists them, what they do, what data they receive and where they are.
Some are used by every account. Others are only used when a business switches on a particular feature — the last column says which. Each business's data is only sent to a provider when that business uses the feature that needs it.
We have written agreements with our sub-processors that protect personal data to the standard UK data protection law requires [confirm each provider's data processing terms are accepted]. Where data leaves the UK, see "International transfers" in our Privacy Policy and Data Processing Addendum.
Hosting and storage
| Provider | Purpose | Data | Location | Used when |
|---|---|---|---|---|
| [Hosting provider] | Hosts the Ventriqa application, database, uploaded files and nightly backups | All data held in Ventriqa | United Kingdom [confirm] | Always |
| Qdrant (Qdrant Cloud) | Vector database for each business's "Business Brain" and chatbot knowledge, used for AI search | Text from business knowledge and uploaded documents (which may include personal data a business chooses to upload), and its numerical representation | [confirm cluster region] | Always |
| [Backup storage provider — e.g. Amazon Web Services S3, Cloudflare R2 or Backblaze B2] | Off-server copy of the nightly database backup | A copy of the full database | [confirm region] | Only if off-site backup is switched on [confirm] |
Artificial intelligence
| Provider | Purpose | Data | Location | Used when |
|---|---|---|---|---|
| OpenAI | AI models that write content, answer chats and messages, summarise calls, power the AI phone assistant's language model, and create text embeddings for search | The text needed for each request: business information, customer messages, call transcripts, content drafts | United States [confirm] | Always |
| Anthropic | Backup AI model, used only if the main provider fails | As for OpenAI | United States [confirm] | Only if enabled [confirm] |
Calls, text and WhatsApp
| Provider | Purpose | Data | Location | Used when |
|---|---|---|---|---|
| Twilio | Phone numbers, call routing, call recording, text messages and phone number type checks | Phone numbers, call audio and recordings, message content | United States [confirm] | When a business uses calls or texts |
| Vapi | Runs the AI phone assistant that answers calls | Caller phone number, call audio, transcripts, the business information the assistant uses | United States [confirm] | When a business uses AI call handling |
| Deepgram (via Vapi) | Turns caller speech into text during AI-answered calls | Call audio | United States [confirm] | When a business uses AI call handling |
| ElevenLabs (via Vapi) | Turns the AI assistant's replies into a spoken voice | The text of the assistant's replies | [confirm] | When a business uses AI call handling |
| Telnyx | Alternative provider for phone numbers and calls | Phone numbers, call audio | United States [confirm] | Only if a business chooses Telnyx |
| Vonage | Alternative provider for phone numbers and calls | Phone numbers, call audio | [confirm] | Only if a business chooses Vonage |
| Meta Platforms (WhatsApp Business Platform) | Sends and receives WhatsApp messages for businesses that connect their own WhatsApp account | Phone numbers, names on WhatsApp profiles, message content | Ireland / United States [confirm] | When a business connects WhatsApp |
Payments
| Provider | Purpose | Data | Location | Used when |
|---|---|---|---|---|
| Stripe | Subscriptions, invoices and credit top-ups | Account owner's name, email, billing details and card details (card details go straight to Stripe) | Ireland / United States [confirm] | Always, for paying customers |
Sign-in and connected services
| Provider | Purpose | Data | Location | Used when |
|---|---|---|---|---|
| Sign in with Google; Google Calendar for bookings; Google Wallet loyalty passes | Name, email and profile picture for sign-in; appointment details (customer name, email, phone, time); customer name and email on wallet passes | United States / Ireland [confirm] | When used | |
| GitHub | Sign in with GitHub | Name, email address, profile picture | United States [confirm] | When used |
| Meta Platforms (Facebook and Instagram) | Publishing posts and reading post and ad performance for accounts a business connects | Post content, page and account identifiers, performance figures | Ireland / United States [confirm] | When a business connects Facebook or Instagram |
Research and lead finding
| Provider | Purpose | Data | Location | Used when |
|---|---|---|---|---|
| Outscraper | Lead finder: searches public business listings and websites for business contact details, and checks email addresses | Search terms (business type and location); returns public business contact details | [confirm] | When a business uses the lead finder |
| Brave Search, Serper, SerpApi and DuckDuckGo | Web search for competitor research and the free tools | Search terms such as business names, locations and industries | United States [confirm] | When research features are used |
| DataForSEO | Search-engine and website data for SEO audits | Website addresses and keywords | [confirm] | When SEO features are used |
Email, monitoring and website delivery
| Provider | Purpose | Data | Location | Used when |
|---|---|---|---|---|
| [Email delivery provider] | Sends account, notification and campaign emails | Recipient name and email address, email content | [confirm] | Always |
| Sentry | Error monitoring, so we can find and fix faults | Error details, the user and organisation ID involved, and technical request data | [confirm US or EU region] | Only if switched on [confirm] |
| Bunny.net (Bunny Fonts) | Delivers the fonts used on our website | Visitor IP address | European Union [confirm] | Always, on our public website |
Services you connect yourself
If you connect Ventriqa to a system of your own — for example by sending new leads to a spreadsheet or automation tool through a webhook — that system is chosen and controlled by you, not a sub-processor of ours.
Changes to this list
We will update this page before we start using a new sub-processor, and email account owners at least 30 days in advance. If you have a reasonable data protection objection, tell us at privacy@ventriqa.com within that period, as set out in our Data Processing Addendum.
Our legal documents
Questions about privacy: privacy@ventriqa.com. Questions about these terms: legal@ventriqa.com.