Sub-processors.
Every third party that processes data when you use Aiva Chat: the few services Aiva Chat contracts with directly, and the services you connect with your own accounts. What each one does, where it runs, and what data it touches.
The short version, before the table:
- Aiva Chat itself uses 3 sub-processors: Amazon Web Services, Stripe and Firecrawl. Each is named below with its purpose and region.
- Aiva Chat's data is hosted on AWS in the United States (N. Virginia). We don't offer a choice of region today.
- Calls, texts and AI processing run on your own Twilio account and your own OpenAI API key. You hold those contracts directly, and their data terms apply.
- Google Calendar, HubSpot, Stripe payment links and webhooks are only used if you connect them.
- We give 30 days' notice before adding or replacing a sub-processor. You can object — see section 04.
Aiva Chat sub-processors.
These are the services Aiva Chat contracts with to run the platform: hosting, storage, email, billing for your Aiva Chat plan, and importing web pages into your assistant's knowledge.
Amazon Web Services is the only one that stores your conversation data. Stripe handles Aiva Chat's own subscription billing, and Firecrawl only sees public web pages you ask Aiva Chat to import.
| Sub-processor | Purpose | Region | Data involved |
|---|---|---|---|
| Amazon Web Services | Application servers, PostgreSQL database (RDS), file storage (S3), transactional email (SES), content delivery (CloudFront) | US East (N. Virginia) | All account and conversation data Aiva Chat stores: transcripts, recordings, contacts, bookings, uploaded files |
| Stripe | Billing for your Aiva Chat subscription | US | Billing contact and payment details for your Aiva Chat plan (card data is handled by Stripe, never stored by Aiva Chat) |
| Firecrawl | Fetching a web page you ask Aiva Chat to import into your assistant’s knowledge | US | The public web page URL and its content |
Services on your accounts.
Aiva Chat connects to these services with credentials you provide: your Twilio account, your OpenAI API key, and any integrations you turn on. You have the contract with each provider directly, so its own data-processing and retention terms apply, and you can review or change those settings in your account with them.
We list them here because they do process your customers' data when Aiva Chat is running. If you disconnect an integration, Aiva Chat stops sending data to it.
| Sub-processor | Purpose | Region | Data involved |
|---|---|---|---|
| Twilio | Phone numbers, voice calls and SMS, using your own Twilio account | Set by your Twilio account | Call audio in transit, SMS content, phone numbers |
| OpenAI | Real-time voice conversations, chat replies, call summaries and SMS drafts, using your own OpenAI API key | Set by your OpenAI account | Conversation audio and text sent for processing |
| Google Calendar | Checking your calendar’s busy times before a booking and writing bookings back to it, on every channel (optional) | Set by your Google account | Appointment details: name, time, contact details you collect |
| HubSpot | Looking up callers and logging calls to your CRM (optional) | Set by your HubSpot account | Caller phone number, name, call summary |
| Stripe (your account) | Sending payment links during calls, and taking booking deposits and selling packages and memberships through Stripe Checkout, using your own Stripe key (optional) | Set by your Stripe account | Payment amount, description, customer name, email and phone number |
| Your webhook endpoints | Signed event deliveries to the webhook endpoints you configure (optional) | Wherever you point them | The event payloads you subscribe to |
How we notify you of changes.
We give 30 days' written notice before adding a new sub-processor or replacing an existing one — sent to the email address on your billing account.
You can also ask to be emailed whenever this list changes. This page is updated within 7 days of any change.
- Email digest — subscribe via support@aivachat.io
Your right to object.
If you object to a new sub-processor on reasonable data-protection grounds, you have two options:
- We work with you to find an acceptable alternative where one exists.
- You can terminate without penalty within 30 days of the change going live. We'll refund any pre-paid annual fees pro-rata and help you export your data.
Object by emailing support@aivachat.io. We respond within 5 business days.
This list is governed by the Data Processing Addendum, section 04 (“Sub-processors”). Read that for the full contractual terms.