The list
| Sub-processor | What it does for us | What it receives | Where | Status |
|---|---|---|---|---|
| Anthropic | The language model behind the assistants: reading a menu photo, suggesting feedback tags, drafting a review reply, the general assistant. One message at a time; no customer roster is ever sent. | The text of the message being handled and the context it needs (a menu, a piece of feedback, a question). | United States | in use |
| Retell AI | The voice agent for Anty Voice: the phone number, the call itself, the recording and the transcript. | The caller’s number, the audio of the call, the transcript, the details the caller gives (name, phone, what they want, an appointment). | United States | in use |
| Supabase | The database, sign-in and file storage for the whole platform. | Everything the platform holds: business records, customer contacts and orders, call records, feedback, staff accounts, encrypted credentials. | United States, AWS us-west-1 (California). Backups in the same region. | in use |
| Vercel | Hosting: the application runs here. | Platform traffic and application data in transit; server functions run in the Washington DC region (iad1) with a global edge. | United States (primary), global edge | in use |
| Resend | Transactional email: sign-in codes, booking confirmations, notices to a business, the weekly digest. | Name, email address and the content of the email. | United States | in use |
| Monnify (Moniepoint) | Payments for Anty Food: collecting a customer’s payment into the restaurant’s own account, paying couriers. Money never touches an Anty Virtual account. | The payer’s bank and card details as Monnify needs them, amounts, references; couriers’ bank accounts for payouts. | Nigeria | in use |
| Meta (WhatsApp Business Platform, Instagram) | Messaging for Anty Connect and Anty Food: the business’s own WhatsApp and Instagram accounts, connected by the business. | Messages between the business and its customers, phone numbers, the templates sent. | Meta’s infrastructure (global) | in use |
| Termii | SMS to Nigerian numbers where WhatsApp cannot reach. | Phone number and the text of the message. | Nigeria | in use |
| Smile Identity | Identity verification for couriers and field staff: the NIN check and the photo match, through Smile’s own capture screen. | The person’s NIN and photograph, sent straight to Smile; Anty Virtual keeps the outcome and a reference, never the images. | Smile’s infrastructure (described in Smile’s privacy notice) | in use |
| Google (Places, Calendar) | Finding a business’s listing and its reviews; writing bookings to a business’s own Google Calendar when the business connects it. | Place ids and public listing details; for a connected calendar, the appointment’s time, the caller’s name and phone, and the service booked. | Google’s infrastructure (global) | in use |
| Cal.com | Booking calendar for two offices that have not yet connected Google Calendar. | Appointment time, the caller’s name, phone and email. | United States | being retired |
OpenAI is used for the voice-over on our own help clips and receives nothing of a client’s, so it is not a sub-processor of client data; it is named here for completeness.
Which carrier holds our phone numbers. Calls run through Retell, whose documentation names Twilio, Telnyx and Vonage as the carriers it works with. Which of them carries Anty Virtual’s numbers has been asked of Retell and will be written here when answered; until then the carrier is a sub-processor of Retell, not named by us.
Before we add one
We will give every client 14 days’ notice by email to its notification address before a new sub-processor receives any of its data, and this page changes on the same day. A client that objects on reasonable data-protection grounds can tell us within those 14 days; we will find another way or, if there is none, let the client end the affected service without penalty. Replacing a sub-processor with another for the same purpose is treated the same way. Removals are noted here with the date.
This commitment starts on 27 September 2026, the date this page was first published. Before that date no notice was given, because no list was published; the list above is complete as of that date.
What each is bound by
| Sub-processor | Its terms on training and use, as read | Source, and when read |
|---|---|---|
| Anthropic | Anthropic’s Commercial Terms of Service, section B (Customer Content): "Anthropic may not train models on Customer Content from Services." | https://www.anthropic.com/legal/commercial-terms (effective 17 June 2025); read 27 September 2026 |
| Retell AI | Retell’s Terms of Service permit Retell to use "aggregated and de-identified data derived from Customer’s and its consumer’s use of the Services for purposes of operating, improving, and developing the Services"; identifiable content is not used for training under those terms, and recording can be switched off per agent. Retell’s calls run over carriers Retell names in its documentation (Twilio, Telnyx, Vonage); which carrier holds Anty Virtual’s numbers is being confirmed with Retell. | https://www.retellai.com/terms-of-service (effective 1 June 2026); https://docs.retellai.com/deploy/custom-telephony; read 27 September 2026 |
| Supabase | Supabase’s DPA prohibits "retaining, using, or disclosing Covered Data for any purpose other than for the business purposes specified in the Agreement" and selling or sharing it; no training use. | https://supabase.com/legal/dpa (version dated 1 August 2026); read 27 September 2026 |
| Vercel | Vercel’s DPA: Vercel "will process Customer Data only in accordance with Customer’s documented, lawful instructions" and "does not sell Customer Data ... and does not share Customer Data with third parties for those third parties’ own business interests." It does not mention model training either way. | https://vercel.com/legal/dpa (effective 31 March 2026); read 27 September 2026 |
| Resend | Resend’s DPA limits processing to the documented instructions and the contracted services and "shall not sell any such personal information"; it gives at least fourteen days’ notice of a new sub-processor. It does not mention model training either way. | https://resend.com/legal/dpa (updated 31 December 2025); read 27 September 2026 |
| Monnify (Moniepoint) | Moniepoint’s privacy policy describes payment processing and a ten-year PCI DSS retention of payment records; it does not mention model training either way. Monnify’s own privacy page could not be read on the day (404); the Moniepoint policy is the one cited. | https://moniepoint.com/privacy-policy (last updated 10 August 2023); read 27 September 2026 |
| Meta (WhatsApp Business Platform, Instagram) | Governed by Meta’s WhatsApp Business and Instagram platform terms, accepted by the business when it connects its account; not read for this page. | Meta platform terms (not summarised here); read 27 September 2026 |
| Termii | Not read for this page. | https://termii.com (terms not summarised here); read 27 September 2026 |
| Smile Identity | Not read for this page. | https://usesmileid.com (terms not summarised here); read 27 September 2026 |
| Google (Places, Calendar) | Governed by Google’s API terms; not read for this page. | Google APIs Terms of Service (not summarised here); read 27 September 2026 |
| Cal.com | Not read for this page. | https://cal.com (terms not summarised here); read 27 September 2026 |
| OpenAI | Not applicable: nothing of a client’s is sent. | n/a; read 27 September 2026 |
A term marked “not read for this page” is one whose page we have not yet summarised here; the supplier is still bound by the data-processing terms it accepted with us. We are working through them and this table changes as each is read. Questions: privacy@antyvirtual.com.