Sub-processors and connected services

Version 2026-09-25

Totem engages the following sub-processors to provide the service under the Data Processing Agreement. Core infrastructure is located in the European Union. Totem will give at least 30 days' notice before adding or replacing a sub-processor.

Data Processing Agreement · Privacy policy

Totem sub-processors

Google Cloud / Firebase

Application hosting, authentication, database, file storage and serverless functions.

Entity: Google Cloud EMEA Limited / Google Ireland Limited (Ireland)

Data: All customer data stored in the platform: account users, contacts and leads, messages, call recordings, transcripts, bookings and files.

Location: European Union: database in the eur3 multi-region, storage and functions in europe-west1 (Belgium).

Safeguards: Stored in the EU. Any access from outside the EEA by Google LLC is covered by the EU-US Data Privacy Framework and Standard Contractual Clauses (Decision 2021/914) in Google's processing terms.

OpenAI

AI models: GPT-Live voice, transcription, reasoning and tools, summaries, assistant preparation and tests.

Entity: OpenAI Ireland Ltd (Ireland), with processing by OpenAI OpCo, LLC (United States)

Data: Call audio, conversation content, prompts and business context, tool inputs and results, managed-agent session state.

Location: United States.

Safeguards: Standard Contractual Clauses (Decision 2021/914) in OpenAI's Data Processing Addendum. Where enabled for assistant preparation or the reasoning and tools behind GPT-Live, OpenAI Agents API processes prompts, supplied business or conversation context, tool inputs/results and session state in the United States. This managed service does not offer Zero Data Retention or an EU data-residency commitment. Session state remains with OpenAI until Totem deletes it. OpenAI API data is not used to train general-purpose models by default; separate provider security and abuse-monitoring retention may apply. For these managed backend sessions, Totem requests deletion after a completed voice call has been reconciled, or after the completed onboarding result has been saved in a durable checkpoint. Abandoned sessions become eligible after seven days of inactivity. Failed deletions remain pending and are retried; completion must be verified. This session-state policy does not erase the separate CRM record, recording, backup or provider security log, each of which follows its applicable retention instructions.

Hostinger

Virtual servers running Totem's automation engine (n8n).

Entity: Hostinger International Limited (Cyprus)

Data: Workflow inputs, conversation context, tool results and execution records.

Location: European Union: France (Paris) and Germany (Frankfurt).

Safeguards: No transfer outside the EEA.

Telnyx

Telephony provided through Totem: numbers, call transport, SIP/WebRTC and recordings. Only where the customer obtains telephony through Totem.

Entity: Telnyx LLC (United States)

Data: Phone numbers, call metadata and call audio.

Location: United States, with points of presence in Europe.

Safeguards: EU-US Data Privacy Framework and Standard Contractual Clauses (Decision 2021/914) in Telnyx's Data Processing Addendum.

Retell AI

Legacy voice agents. Only for customers whose assistants still run on Retell; no new assistants use it.

Entity: Retell AI, Inc. (United States)

Data: Call audio, transcripts, call metadata and summaries.

Location: United States.

Safeguards: Standard Contractual Clauses (Decision 2021/914) in Retell's Data Processing Agreement.

Customer-connected services

These services are contracted by the customer with its own accounts and operate under the customer's own agreement with each provider. They are not Totem sub-processors; they are listed for transparency.

Meta (WhatsApp, Instagram, Messenger)

Messaging channels the customer connects with its own Meta business accounts.

Entity: Meta Platforms Ireland Ltd / WhatsApp Ireland Ltd

Data: Contact identifiers, messages, attachments and delivery metadata.

Location: Under Meta's terms accepted by the customer.

Safeguards: Governed by the customer's own agreement with Meta.

Customer telephony accounts (e.g. Zadarma, Telnyx)

Numbers, calls and SMS the customer contracts in its own operator account and connects to the platform.

Entity: The operator contracted by the customer (e.g. Voice Cloud S.L. for Zadarma, Spain)

Data: Numbers, call metadata, recordings and SMS content.

Location: Under the operator's terms accepted by the customer.

Safeguards: Governed by the customer's own agreement with the operator.

Google Workspace / Microsoft 365

Calendar, email and meetings the customer connects.

Entity: The customer's own Google or Microsoft account

Data: Calendar events, outgoing email and authorized meeting data.

Location: Under the customer's own account terms.

Safeguards: Governed by the customer's own agreement with that provider.

Stripe

Stripe Payments Europe, Limited (Ireland) processes customers' payments to Totem as payment service provider; it handles account billing data, not the data of the customer's own clients. See the Privacy Policy.

For questions about providers or privacy, write to hello@totemstudio.ai.