Version 2026-08-25 · Last updated: 2026-08-24
Subprocessor List
Aimée LLC 30 N Gould St, Ste R, Sheridan, WY 82801, USA Email: founder@tryaimee.com
Version: 2026-08-25 Last Updated: August 25, 2026
1. What Is a Subprocessor?
When Aimée processes personal data on your behalf (as your data processor under GDPR), we engage third-party companies — called subprocessors — to perform specific processing activities necessary to provide the Service. A subprocessor is any third party that Aimée authorizes to access or process personal data that belongs to you (the Controller) or your callers and patients.
We are committed to transparency about who handles your data and on what basis. This page lists all active subprocessors, their roles, locations, and the legal safeguards governing data transfers to them.
How You Are Notified of Changes
We will give you at least 30 days' advance email notice before adding or replacing any subprocessor. Notice is sent to the email address on file for your Aimée account. No action is required on your part unless you wish to object (see Section 3 below).
This list is updated within seven (7) days of any change taking effect.
2. Active Subprocessors
| Provider | Legal Entity | Registered Address | Purpose | Data Categories Processed | Location | Legal Safeguards | DPA |
|---|---|---|---|---|---|---|---|
| Supabase | Supabase Inc. | 970 Toa Payoh North, #07-04, Singapore 318992 | Database hosting & authentication | Account data, call transcripts, all stored personal data | London, United Kingdom (eu-west-2) | DPA executed; database, authentication, and storage use the configured London region | DPA |
| Deepgram | Deepgram Inc. | 3260 Hillview Ave, Palo Alto, CA 94304, USA | Speech-to-text transcription | Call audio (real-time stream), caller phone numbers, call transcripts | USA | DPA executed; EU SCCs Module 2 (Decision 2021/914) + UK IDTA | DPA |
| ElevenLabs | ElevenLabs Inc. | 169 Madison Ave, Suite 2895, New York, NY 10016, USA | Text-to-speech voice synthesis | AI-generated voice output text; no caller personal data sent | USA | DPA executed; EU SCCs Module 2 + UK IDTA | DPA |
| Groq | Groq Inc. | 2635 N First St, Suite 305, San Jose, CA 95134, USA | LLM inference (primary) | Call transcripts, knowledge base content, conversation context | USA | DPA executed; EU SCCs Module 2 + UK IDTA | Privacy Policy |
| xAI | xAI Corp. | 216 Park Road, Burlingame, CA 94010, USA | LLM inference (fallback) | Call transcripts, conversation context (fallback only) | USA | DPA executed; EU SCCs Module 2 + UK IDTA | Privacy Policy |
| Vercel | Vercel Inc. | 340 Pine Street, Suite 701, San Francisco, CA 94104, USA | Frontend hosting & CDN | Account session data, IP addresses (via edge network) | USA (with global edge locations) | DPA executed; includes EU SCCs and the UK IDTA | DPA |
| Railway | Railway Corp. | 548 Market St PMB 68148, San Francisco, CA 94104, USA | Backend application hosting | All personal data processed by the backend service | USA | DPA executed; EU SCCs Module 2 + UK IDTA | Privacy Policy |
| Telnyx | Telnyx LLC | 333 W. Wacker Drive, Suite 1410, Chicago, IL 60606, USA | Telephony infrastructure (EU/US) | Caller phone numbers, call audio (real-time), call metadata | EU + USA | DPA executed; EU SCCs Module 2 for US-routed calls + UK IDTA | DPA |
| Stripe | Stripe Inc. | 510 Townsend Street, San Francisco, CA 94103, USA | Payment processing | Billing address, tokenized payment reference, last 4 digits of card, invoice history | USA | DPA executed; EU SCCs Module 2 + UK IDTA; PCI-DSS Level 1 certified | DPA |
| Resend | Plus Five Five, Inc. (d/b/a Resend) | 2261 Market Street #5039, San Francisco, CA 94114, USA | Transactional email delivery (billing, callback/task and clinic notification alerts, and the single automated "Get Started" reminder email to prospective customers who did not finish registration) | Recipient email address, email subject/body content generated by Aimée (no call audio or transcript content) | USA | DPA executed; EU SCCs Module 2 + UK IDTA | DPA |
Notes:
- Groq and xAI DPAs are accepted automatically when the applicable service account is registered. Their links in the DPA column point to the providers' published privacy information rather than to separately signed DPA documents.
- Aimée does not sell or share personal data with any third party for marketing, advertising, or profiling purposes.
3. How to Object to a Subprocessor Change
If you receive a subprocessor change notice and wish to object:
-
Send an email to founder@tryaimee.com with the subject line:
Subprocessor Objection — [Provider Name] -
Include in your email:
- Your organization name and account email
- The subprocessor you are objecting to
- The specific reason for your objection
-
Timeline: Your objection must be received within 14 days of the date of the change notice email.
-
Resolution: We will endeavor to resolve your objection within 14 days of receipt. We may propose alternative measures or processing arrangements to address your concern.
-
Termination right: If the objection cannot be resolved to your reasonable satisfaction, you may terminate your Aimée subscription without penalty by providing written notice to founder@tryaimee.com within 30 days of your original objection. Your subscription will remain active until the end of the current billing period.
4. Subprocessor Change History
The table below records all past changes to this subprocessor list. New entries are added when a subprocessor is added, replaced, or removed, or when the services they provide materially change.
| Date | Change Type | Provider | Description | Customer Notice Sent On |
|---|---|---|---|---|
| 2026-08-24 | Record correction | Resend / all active providers | Reconciled Resend across the DPA and public lists and removed an unverified universal governmental-request commitment. No subprocessor was added, replaced, or removed. | Not required — no provider change |
| 2026-08-18 | Record correction | Supabase / Vercel | Corrected Supabase data residency to the configured UK region and recorded the safeguards provided by the Vercel Pro DPA. No subprocessor was added, replaced, or removed. | Not required — no provider change |
5. Automatic Notifications — No Subscription Needed
All active Aimée Customers (clinic owners and managers) automatically receive email notifications of subprocessor changes at the email address on file for their account. No separate subscription or opt-in is required.
If you are a clinic manager and are not receiving notifications, please ask your clinic owner to verify that your account email address is current in Settings → Team.
To update your account email address, visit Settings → Profile in your Aimée dashboard.
This subprocessor list is maintained by Aimée LLC. Version 2026-08-25. For questions, contact founder@tryaimee.com.