1. Processors and independent controllers
A sub-processor processes personal data on our behalf, under a written agreement that requires it to protect the data and use it only for the service it provides to us. Some providers, such as payment providers and platforms you connect yourself, act as independent controllers: they decide how to use the data under their own terms and privacy policies. Both are listed below so you have the full picture.
2. Current providers
Website, email and support
Used across the company, including ennovaq.com.
| Provider | Purpose | Data | Location | Used for |
|---|---|---|---|---|
| Vercel Inc. | Hosting, content delivery and cookieless analytics for ennovaq.com | Request data such as IP address, browser and pages visited | United States; served from a global edge network | ennovaq.com |
| Zoho Corporation | Business email for @ennovaq.com addresses | Emails you send us and our replies | United States | ennovaq.com |
| Meta Platforms, Inc. (WhatsApp)Independent controller | Support and payment confirmations when you contact us on WhatsApp | Phone number, messages and any screenshots you send | Global | ennovaq.com, EchoClone, ReVidGen, Guftagu |
| Resend, Inc. | Transactional email: sign-in codes, receipts and account notices | Email address and the message sent | United States | Guftagu, SpikeGuru |
Payments
Payment providers process your payment details as independent controllers under their own terms and privacy policies. We never see full card numbers.
| Provider | Purpose | Data | Location | Used for |
|---|---|---|---|---|
| Paddle.com Market LimitedIndependent controller | Merchant of Record and reseller for card payments where Paddle checkout is shown | Name, email, billing address, payment details and order | United Kingdom | EchoClone, ReVidGen, SpikeGuru, Guftagu |
| Lemon Squeezy, LLCIndependent controller | Merchant of Record for SpikeGuru subscriptions | Name, email, billing address, payment details and order | United States | SpikeGuru |
| Easypaisa, JazzCash, NayaPay and Pakistani banksIndependent controller | Local payments in Pakistan, confirmed manually | Payer name, wallet or account number, amount and reference | Pakistan | Guftagu |
AI models and product infrastructure
Model providers receive only the content needed to produce a response and may not train their models on it.
| Provider | Purpose | Data | Location | Used for |
|---|---|---|---|---|
| OpenAI | Generating answers | Message content sent for a response | United States | Guftagu |
| Anthropic, PBC | Generating answers (Guftagu) and AI audits (SpikeGuru) | Message content, or video and channel details submitted for analysis | United States | Guftagu, SpikeGuru |
| DeepSeek | Generating answers on lower-cost tiers; never used for accounts with data-residency requirements, and can be switched off in Settings | Message content sent for a response | China | Guftagu |
| Supabase, Inc. | Authentication and database | Account details and application data | Contracted region | SpikeGuru |
| Functional Software, Inc. (Sentry) | Error monitoring | Technical error reports, which can include a user identifier | United States | SpikeGuru |
| Google LLC (YouTube API Services)Independent controller | Reading the YouTube channel data you choose to connect | Channel profile, statistics and analytics, read-only | United States | SpikeGuru |
| Object storage provider | Storing uploaded files | Uploaded files, encrypted at rest | Contracted region | Guftagu |
| Managed database and hosting provider | Running the service | Account records and conversation history | Contracted region | Guftagu |
3. Products being itemised
- EchoClone uses providers for cloud hosting, encrypted storage for voice samples and audio, and speech-model compute. Each is bound by a data processing agreement, and we will name them to you on request at info@ennovaq.com while this list is being consolidated.
- ReVidGen uses providers for cloud hosting, media storage, and video, voice and image model providers. Each is bound by a data processing agreement, and we will name them to you on request at info@ennovaq.com while this list is being consolidated.
4. How we tell you about changes
We update this page at least 30 days before a new sub-processor starts processing personal data, except where an urgent change is needed for security or continuity, in which case we update it as soon as we can and explain why.
Business customers covered by our Data Processing Addendum can receive change notices by email: write to info@ennovaq.com with the subject "Sub-processor updates". The DPA explains how to object to a new sub-processor.
5. Questions
Questions about our providers go to info@ennovaq.com.