What this page is
MairyAI uses the third-party providers below to deliver the Service. Each one is a subprocessor under our Data Processing Addendum ("DPA"). Each is bound by a written contract requiring protections at least as strong as our DPA, including the prohibition on using customer content to train AI models and on selling or sharing personal information. MairyAI remains fully responsible to our customers for each subprocessor's performance.
We give customers at least 30 days' notice before adding or replacing a subprocessor that will process customer personal information. To receive those notices, email contact@mairyai.com. Customers may object on reasonable data-protection grounds, as described in Section 6 of the DPA.
Current subprocessors
Core call handling
These providers are in the live call path. A call cannot be answered without them.
| Provider | Role in the Service | Data it receives | Processing location |
|---|---|---|---|
| Twilio Inc. | Telephony infrastructure. Carries the inbound phone call, provides the phone number, and streams call audio to and from the Service. Messaging is not offered under the launch plan and no message is sent or received on your behalf. | Caller phone number, number called, call time and duration, call audio during the call, call status metadata. | United States, with global carrier interconnection |
| ElevenLabs Inc. | Conversational AI for the call — speech recognition, the conversation model, and the assistant's spoken voice. Twilio streams the live call audio to ElevenLabs for the duration of the call. | Live call audio in both directions, the conversation transcript, and the assistant's configuration. | United States configured where offered |
| Anthropic, PBC | AI language processing for workspace setup — drafts the assistant's business profile and suggestions from information the customer provides. | Business details the customer supplies, such as company name, website text, and services. No caller audio. | United States configured where offered |
Model training is off, and that is a commitment we make to you.
- ElevenLabs — used on paid API terms with model training switched off for customer content, so call audio and conversation content are not used to train ElevenLabs models.
- Anthropic — used on API terms. Content submitted through the API is not used to train Anthropic models. API content may be retained for a limited period for abuse and misuse monitoring.
These are the terms we rely on to make the commitment in the Privacy Policy. If a provider changed them, we would move providers or tell customers before anything changed — we would not weaken the commitment quietly.
Platform infrastructure
| Provider | Role in the Service | Data it receives | Processing location |
|---|---|---|---|
| Render Services, Inc. | Application hosting — runs the MairyAI web application, API, and background workers, and hosts the managed database. | All customer and call data stored by the Service, encrypted at rest. | United States |
| Cloudflare, Inc. | Network routing, DNS, TLS termination, and DDoS protection in front of the application. | Web request metadata and IP addresses in transit. | United States, with global edge routing |
Account, billing, and operations
| Provider | Role in the Service | Data it receives | Processing location |
|---|---|---|---|
| Okta, Inc. (Auth0) | Authentication — signs users in to the dashboard and manages sessions and multi-factor authentication. | Customer user email address, name, authentication events, IP address. No caller data. | United States |
| Stripe, Inc. | Payment processing — hosted checkout, subscriptions, invoices, and the billing portal. | Billing contact name, email, billing address, payment card details (collected by Stripe directly — MairyAI never receives full card numbers), subscription and invoice records. No caller data. | United States |
| Functional Software, Inc. (Sentry) | Error monitoring — captures application errors and performance data so we can find and fix faults. | Technical error data, stack traces, request metadata, and user or workspace identifiers. Configured to scrub personal information and call content. Should receive no caller data. | United States |
| Resend, Inc. | Transactional email — sends account, billing, security, and notification emails. | Recipient email address and the content of the email sent, which may include call notification summaries where the customer enables them. | United States |
Customer-connected integrations
| Provider | Role in the Service | Data it receives | Processing location |
|---|---|---|---|
| Google LLC | Calendar integration — creates, updates, and reads appointments in a Google Calendar account the customer connects. | Appointment details, including the caller's name, telephone number, and the reason for the appointment as captured on the call. | United States / Google global infrastructure |
| Rentec Direct | Property-management integration — recognizes callers who are the customer's tenants or leads and logs a tenant's repair request as a work order, in a Rentec Direct account the customer connects with an API key the customer creates and can delete at any time. It also reads back the status of a repair, describes the vacancies the customer advertises, and records a note of each call. | The caller's name and telephone number; what the caller reported or asked for, including access instructions for a repair; a summary of the call with a link to it in the dashboard; and, for a new prospect, a lead record with their name, number and what they asked about, the most they said they could pay (or, where they gave no figure, the rent of the listing they asked about or, failing that, of one the customer advertises) and that listing's town as the area to search. | A United States company; Rentec Direct's own terms govern where it processes data |
Customer-connected integrations are different. Google Calendar and Rentec Direct are used only when a customer connects their own account, and the data written there lands in a system the customer controls. The customer's agreement with that provider governs it, and deleting data from MairyAI does not delete appointments, work orders, messages, or leads already written into the customer's calendar or Rentec Direct account. The customer must delete those separately.
What MairyAI reads from Rentec Direct. To recognize a caller and answer them, MairyAI reads the customer's tenant, lead, property, work-order, and listing records through the API key the customer creates, and uses them only for that customer's calls. It holds them in memory for about ten minutes and keeps no standing copy: what a single call needs, such as the caller's name and the home on file, is kept encrypted, expires after fifteen minutes and is then deleted, and each record MairyAI writes is kept only as a reference, so it is never written twice.
About the "processing location" column
Read this column as where each provider is configured to process, not as a guarantee.
- Storage is United States-based. Our databases and stored transcripts sit in United States regions. Conversation audio processed by ElevenLabs resides with ElevenLabs under our configuration.
- Transit and edge processing are not. Cloudflare operates a global edge network, so encrypted traffic may be routed through locations outside the United States. Twilio interconnects with global carriers.
- Some providers do not offer a region guarantee at our tier. Where a United States region is offered we configure it; where it is not, the provider's own terms govern.
- Support and engineering access may come from outside the United States under a provider's standard terms.
MairyAI does not offer data residency guarantees. A customer with a contractual United States-only processing requirement should raise it before signing up, because we cannot meet it at launch. This matches Section 9 of the Privacy Policy and Section 5.1 of the DPA.
What is not on this list
- Messaging. SMS, MMS and WhatsApp are not offered under the launch plan. Twilio appears above as telephony infrastructure; no messaging channel is enabled and no message is sent on a customer's behalf.
- We do not use advertising networks, data brokers, or marketing analytics providers that receive personal information.
- We do not sell personal information or share it for cross-context behavioral advertising.
- Providers that never receive customer personal information — such as source-control, internal documentation, or developer tooling — are not subprocessors and are not listed.
- Our own affiliates and contractors, who are bound by the same obligations as our employees.
Data flow in one paragraph
A caller dials the customer's number. Twilio carries the call and streams the audio to ElevenLabs, whose conversational AI listens, decides how to respond, and speaks the reply back through Twilio. After the call, the structured result — metadata, summary, outcome, booking — is stored by the application on Render, behind Cloudflare. If the customer enabled recording or transcripts, that content is encrypted and stored by the Service. If a booking was made, it is written to the customer's Google Calendar. If the customer connected Rentec Direct, the caller is looked up there at the start of the call, and a repair request, a note of the call, or a new lead is written to the customer's Rentec Direct account. The customer signs in through Okta/Auth0 to see the result, pays through Stripe, receives notifications through Resend, and any application errors along the way are reported to Sentry.
Contact
Questions about this list: contact@mairyai.com Subprocessor objections: contact@mairyai.com, per Section 6 of the DPA.
Anabtawi Labs LLC, a Florida limited liability company, trading as MairyAI. Registered address: 485 Brickell Ave, Apt 4807, Miami, FL 33131.