Legal

Sub-processors

Last updated: October 22, 2026

Halo AI, Inc. uses the third parties listed on this page (“Sub-processors”) to deliver the Services. Each one has been assessed before engagement and is bound by a written contract with data protection terms at least as protective as our Data Processing Addendum. This page is Annex 3 of that DPA and is incorporated into it.

All Sub-processors process data in the United States unless stated otherwise. Our platform is hosted in the United States, and international transfers are covered by Section 6 of the DPA.

How we notify you of changes

We update this page and email the owners of every active workspace at least 30 days before a new Sub-processor starts processing Customer Data. The only exception is an urgent replacement needed to keep the Services secure or available, in which case we notify you as soon as practicable. Section 5 of the DPA describes your right to object to a new Sub-processor.

To receive these notices at an additional address, email support@haloagents.ai with the subject “Sub-processor notifications”.

Current Sub-processors

The table lists every Sub-processor that may process Customer Data, what it does for the Services, the categories of data it receives and where it processes them.

Sub-processor	Purpose	Data processed	Location
Supabase Supabase, Inc.	Managed Postgres database, authentication and file storage for the Halo AI platform. Supabase runs on Amazon Web Services.	All Customer Data at rest, including conversations, contacts, knowledge, tickets and configuration.	United States (AWS us-east-1)
Vercel Vercel, Inc.	Hosting and serverless compute for the dashboard, API, SDK delivery and customer help centers; hosting, media storage and privacy-friendly web analytics for haloagents.ai.	All Customer Data in transit and during processing; website visitor analytics.	United States, with static content served from Vercel's global edge network
Anthropic Anthropic, PBC	Large language models that power the AI agents, Ask AI, drafts, summaries, classification and knowledge distillation. Anthropic does not use data sent through its API to train its models.	Conversation content, the knowledge and records retrieved to answer a request, and the instructions configured for an agent.	United States
Voyage AI Voyage AI (MongoDB, Inc.)	Text embeddings and re-ranking for knowledge retrieval.	Knowledge base text, conversation excerpts and search queries.	United States
Firecrawl	Fetching and converting web pages at the URLs a customer submits as knowledge sources.	Publicly accessible page content at customer-provided URLs.	United States
ElevenLabs ElevenLabs, Inc.	Speech synthesis for voice replies, where a customer enables voice.	Agent reply text.	United States
HeyGen	Interactive video avatar sessions, where a customer enables them.	Agent reply text and session metadata.	United States
Inngest Inngest, Inc.	Orchestration of background jobs such as crawls, integration syncs, outreach sends, AI runs and billing reconciliation.	Job payloads: record identifiers, references and the inputs each job needs.	United States
Upstash Upstash, Inc.	Redis for rate limiting and short-lived caching.	IP addresses, account identifiers and cached records.	United States
Mailgun Mailgun Technologies, Inc. (Sinch)	Sending and receiving email for the inbox email channel and Outreach, and reporting delivery, bounce and complaint events.	Email addresses, message content, headers and delivery metadata.	United States
Resend Resend, Inc.	Transactional email from Halo AI to dashboard users: verification, invitations, notifications, digests and shared reports.	Authorized User email addresses and notification content.	United States
Stripe Stripe, Inc.	Subscription billing, invoicing and payment processing for Halo AI plans.	Billing contact details, invoices and payment information. Card details are collected and stored by Stripe, not by Halo AI.	United States
Sentry Functional Software, Inc.	Application error and performance monitoring. Personal details are scrubbed before events are sent.	Technical error data, request metadata and pseudonymous identifiers.	United States
Linear Linear Orbit, Inc.	Halo AI's internal issue tracking for bugs and escalations raised with Halo AI's own support team.	Summaries of support conversations with Halo AI and the reporter's contact details.	United States
Slack Slack Technologies, LLC (Salesforce)	Internal operational alerts to the Halo AI team.	Workspace names and operational metadata. No conversation content.	United States

Supabase
Supabase, Inc.
Purpose
Managed Postgres database, authentication and file storage for the Halo AI platform. Supabase runs on Amazon Web Services.
Data processed
All Customer Data at rest, including conversations, contacts, knowledge, tickets and configuration.
Location
United States (AWS us-east-1)
Vercel
Vercel, Inc.
Purpose
Hosting and serverless compute for the dashboard, API, SDK delivery and customer help centers; hosting, media storage and privacy-friendly web analytics for haloagents.ai.
Data processed
All Customer Data in transit and during processing; website visitor analytics.
Location
United States, with static content served from Vercel's global edge network
Anthropic
Anthropic, PBC
Purpose
Large language models that power the AI agents, Ask AI, drafts, summaries, classification and knowledge distillation.
Anthropic does not use data sent through its API to train its models.
Data processed
Conversation content, the knowledge and records retrieved to answer a request, and the instructions configured for an agent.
Location
United States
Voyage AI
Voyage AI (MongoDB, Inc.)
Purpose
Text embeddings and re-ranking for knowledge retrieval.
Data processed
Knowledge base text, conversation excerpts and search queries.
Location
United States
Firecrawl
Purpose
Fetching and converting web pages at the URLs a customer submits as knowledge sources.
Data processed
Publicly accessible page content at customer-provided URLs.
Location
United States
ElevenLabs
ElevenLabs, Inc.
Purpose
Speech synthesis for voice replies, where a customer enables voice.
Data processed
Agent reply text.
Location
United States
HeyGen
Purpose
Interactive video avatar sessions, where a customer enables them.
Data processed
Agent reply text and session metadata.
Location
United States
Inngest
Inngest, Inc.
Purpose
Orchestration of background jobs such as crawls, integration syncs, outreach sends, AI runs and billing reconciliation.
Data processed
Job payloads: record identifiers, references and the inputs each job needs.
Location
United States
Upstash
Upstash, Inc.
Purpose
Redis for rate limiting and short-lived caching.
Data processed
IP addresses, account identifiers and cached records.
Location
United States
Mailgun
Mailgun Technologies, Inc. (Sinch)
Purpose
Sending and receiving email for the inbox email channel and Outreach, and reporting delivery, bounce and complaint events.
Data processed
Email addresses, message content, headers and delivery metadata.
Location
United States
Resend
Resend, Inc.
Purpose
Transactional email from Halo AI to dashboard users: verification, invitations, notifications, digests and shared reports.
Data processed
Authorized User email addresses and notification content.
Location
United States
Stripe
Stripe, Inc.
Purpose
Subscription billing, invoicing and payment processing for Halo AI plans.
Data processed
Billing contact details, invoices and payment information. Card details are collected and stored by Stripe, not by Halo AI.
Location
United States
Sentry
Functional Software, Inc.
Purpose
Application error and performance monitoring. Personal details are scrubbed before events are sent.
Data processed
Technical error data, request metadata and pseudonymous identifiers.
Location
United States
Linear
Linear Orbit, Inc.
Purpose
Halo AI's internal issue tracking for bugs and escalations raised with Halo AI's own support team.
Data processed
Summaries of support conversations with Halo AI and the reporter's contact details.
Location
United States
Slack
Slack Technologies, LLC (Salesforce)
Purpose
Internal operational alerts to the Halo AI team.
Data processed
Workspace names and operational metadata. No conversation content.
Location
United States

Integrations you choose to connect

The services below are not Sub-processors. Data flows to them only when you connect them to your workspace, and only as needed for the feature you enable. Your own agreement with each provider governs how it handles that data, and you can disconnect an integration at any time from the dashboard.

Calendly: meeting scheduling from agent conversations.
Fathom: call recordings and transcripts.
HubSpot: CRM contacts, companies, deals and activity.
Intercom: migration and sync of conversations, contacts and articles.
Linear: bug reports and issue tracking in your workspace.
Orbit Forms: lead forms and routing.
PandaDoc: contracts and documents.
Sight AI: forwarding outreach and collaboration emails to your Sight AI Outreach Agent and syncing replies back.
Slack: notifications, digests and the internal Slack agent.
Stripe: subscription and revenue data from your own Stripe account.
Zoom: meeting recordings and transcripts.

The same applies to AI assistants and developer tools that you connect to the Halo MCP server, such as Claude (Anthropic), ChatGPT (OpenAI), Cursor and other MCP-compatible clients. Data you request through such a client is sent to that client’s provider under its own terms and privacy policy, and you control which Halo AI tools the client may use.

Change log

October 22, 2026: First published version of this list.