We publish this in full rather than summarising it. A data protection officer reviewing us should be able to check this page against what they can observe, and find no surprises.
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database and file storage (the CRM itself) | EU — Paris, France |
| Vercel | Application hosting and serverless compute | EU — Paris (cdg1); company US-based |
| Upstash | Rate limiting (IP addresses only) | EU |
| DeepSeek Customers requiring EU-only processing can be moved to Mistral (France) on request. | Generates assistant replies. Receives the message content and the surrounding conversation. | China Outside the EEA — SCCs apply |
| Mistral AI Used only when selected for the account. | EU alternative for generating assistant replies | EU — France |
| OpenAI Used only when selected for the account. | Alternative model, and speech transcription | United States Outside the EEA — SCCs apply |
| Google (Gemini) Used only when selected for the account. | Alternative model and image generation | United States Outside the EEA — SCCs apply |
| Anthropic Used only when selected for the account. | Alternative model | United States Outside the EEA — SCCs apply |
| Meta Platforms (Facebook, Instagram, WhatsApp) Only when the customer connects those channels. | Delivers and receives messages and comments on the customer's own connected accounts | United States / global Outside the EEA — SCCs apply |
| Twilio Only when the customer connects SMS/WhatsApp via Twilio. | WhatsApp and SMS delivery | United States / EU Outside the EEA — SCCs apply |
| Telegram Only when the customer connects Telegram. | Message delivery on Telegram | Outside the EEA Outside the EEA — SCCs apply |
| Resend | Transactional email delivery | United States / EU Outside the EEA — SCCs apply |
| Vapi Only when voice calling is enabled. | AI voice calls — audio, recordings and transcripts | United States Outside the EEA — SCCs apply |
| ElevenLabs Only when voice replies are enabled. | Speech synthesis for voice replies | United States Outside the EEA — SCCs apply |
| AssemblyAI / Groq Only when voice notes are used. | Speech-to-text transcription | United States Outside the EEA — SCCs apply |
| Cloudinary | Image and video hosting and transformation | United States / EU Outside the EEA — SCCs apply |
| Creatomate Only when video generation is used. | Video rendering | EU — Netherlands |
| fal.ai / Kling / Runway / HeyGen Only when video generation is used. Listing media only — not lead data. | AI video generation from listing photos | United States / global Outside the EEA — SCCs apply |
| Stripe | Subscription billing (customer account holders only, not their leads) | United States / EU Outside the EEA — SCCs apply |
| Google (OAuth, Maps, Places/Reviews) | Sign-in, map display, review sync | United States Outside the EEA — SCCs apply |
| TikTok / YouTube Only when the customer connects those channels. | Publishing to the customer's own connected social accounts | United States / global Outside the EEA — SCCs apply |
| Orgo Only for accounts with an automation VM. | Hosted automation workers for scraping and scheduled jobs | United States Outside the EEA — SCCs apply |
EU-only processing
Several providers above operate outside the EEA, and the default AI model (DeepSeek) processes data in China. Customers who require personal data to stay within the EU can ask us to configure their account accordingly — principally by switching the AI model to Mistral AI (France) and leaving optional channels disconnected. Write to partners@my5thstar.com.
Changes to this list
We notify customers by email at least 30 days before adding a sub-processor that handles personal data, so there is time to object as set out in the Data Processing Agreement.