Subprocessor categories
This page accompanies the Privacy Policy and lists the categories of service provider that process personal data on our behalf, what each does, and what it can see.
Why categories rather than company names
Data-protection law lets a controller disclose "recipients or categories of recipients". We disclose categories, for two reasons.
It is meaningful to you. What matters for your privacy is what kind of provider touches your data and what they can see — not a brand name you would then have to research.
It keeps this page honest. Our provider stack is commercially sensitive and it changes. A page listing specific companies goes stale the moment one is swapped, and a stale privacy disclosure is worse than a general one. This page can be updated when a provider changes without re-versioning the Privacy Policy, which is exactly why it is a separate document.
If you need the specific identity of a provider handling your data — for a data protection impact assessment, a due-diligence review, or a rights request — write to privacy@callmyai.ai and ask. We will tell you.
The categories
| Category | What it does | What it can see |
|---|---|---|
| Hosting and application infrastructure | Runs the website and application | Technical and log data; data in transit to the application |
| Database, authentication, and file storage | Stores accounts, call records, and creator-submitted material | Account data, hashed fan identifiers, encrypted records |
| Voice and language compute | Runs the models that generate a persona's speech and responses | Conversation content during a call |
| Speech-to-text | Converts caller speech into text so the persona can respond | Call audio in transit and the resulting text |
| Identity and age verification | Verifies a creator is a real adult from government ID | Creator legal name, date of birth, ID document, verification result |
| Deepfake and voice-match verification | Checks a creator's verification recording is genuinely that creator | Creator verification recording and voice fingerprint |
| Image moderation | Screens creator profile images | Creator profile images |
| Payment processing | Takes fan payments as merchant of record | Fan payment and billing details — held by the processor, not by us |
| Creator payouts | Pays creators their share | Creator payout account details |
| Tax reporting | Produces the tax filings we are legally required to make | Creator identity and earnings data |
| Telephony and call routing | Connects inbound phone calls to the platform | Phone numbers in transit — hashed at our boundary before storage |
| Transactional email | Sends receipts, confirmations, and account notices | Recipient email address and message content |
| Error monitoring | Alerts us when something breaks | Technical diagnostics, with personal data redacted |
| Caching | Holds short-lived operational state | Ephemeral, non-content operational data |
Two things worth calling out
Fan payment identity sits with the payment processor, not with us. Our processor acts as merchant of record, which means it — not CallMyAI — holds the fan's billing relationship and card identity. That is a deliberate part of the anonymization design, and it also means a lawful request for a fan's payment identity has a real place to go that is not us. See Law Enforcement Guidelines.
Phone numbers are hashed at our boundary. A telephony provider necessarily handles a real phone number to route a call — that is what routing is. The number is converted to a per-creator one-way hash before it is written to our systems, so what we store and what a creator sees is never the real number. See How caller anonymization works.
Requirements we place on every provider
Each processes personal data only on our documented instructions, under a written agreement with confidentiality and security obligations, and only for the purpose described above. Where a provider is outside the UK, EEA or Switzerland, transfers rely on the mechanism described in the Privacy Policy.
We assess adult-content and AI-voice acceptability before engaging any provider that touches conversation content. A provider whose terms prohibit our lawful use is not one we can rely on, regardless of price.
How to reach us
Questions about a specific provider, or a due-diligence request:
- Data and privacy requests — privacy@callmyai.ai
CallMyAI LLC, 30 N Gould St, Ste N, Sheridan, WY 82801