Who helps us run the Service
Jomioz uses the following subprocessors to help provide the Service. We require contracts that restrict their use of personal data (including GDPR Art. 28 terms where applicable). Which ones process your data depends on the features you enable.
Our application servers and database run on Render in Frankfurt, Germany. Other providers operate in the EEA, the United Kingdom, the United States and other countries; where personal data moves from the EEA or UK to a country without an adequacy decision (for example to a subprocessor in the United States) we use safeguards such as Standard Contractual Clauses and the UK Addendum or International Data Transfer Agreement (see our Privacy Policy, International transfers). Locations below are where the provider mainly processes data; “Global” means the provider operates its own multi-region network.
| Subprocessor | Purpose | Personal data involved | Typical location |
|---|---|---|---|
| Render | Application servers, database and cache | All Service data (account, workspace and Customer Data) | Germany (Frankfurt) |
| Vercel | Hosting for the Jomioz app and website; AI Gateway; cookieless site analytics | Request metadata (IP, browser); AI prompts routed to model providers | Global edge / US |
| Amazon Web Services (AWS) | File and photo storage (S3) and delivery (CloudFront) | Uploaded files, photos, documents | EU |
| Stripe | Subscription billing; Jomioz Payments (customer charges) | Billing contact, payment and transaction data | US / global |
| Resend | Transactional and onboarding email delivery | Recipient email address, name, message content | US / global |
| Twilio | SMS, voice and phone numbers, where you connect telephony | Phone numbers, message content, call metadata | US / global |
| Zernio (with Meta’s WhatsApp platform and Google Business Profile) | WhatsApp messaging, and reading and replying to Google reviews, where you connect them | Phone numbers, message content, delivery status; reviewer names, review text and your replies | Global |
| Retell AI | Jomioz AI Receptionist voice calls, where enabled | Caller phone number, call audio and transcripts | US |
| OpenAI (including Realtime) | Assistive AI drafting, transcription and Jomioz AI Receptionist calls (eligible plans), routed through Vercel AI Gateway | Prompts, dictated audio, generated text; no training on Customer Data | US |
| Anthropic | Assistive AI drafting of quotes and estimates (eligible plans), routed through Vercel AI Gateway | Prompts and generated text; no training on Customer Data | US |
| Mapbox | Maps, address search and routing | Addresses, coordinates, search text | US |
| Invopop | E-invoicing and tax-authority submission in supported countries | Invoice data: parties, tax IDs, line items, totals | Global |
| Xero | Accounting sync, only if you connect it | Customer, invoice and payment records you choose to sync | Global |
| Intuit (QuickBooks Online) | Accounting sync, only if you connect it (US companies) | Customers, products, invoices, payments and payouts you choose to sync | US |
| Optional Google sign-in; Analytics and Ads after consent (not under GPC) | Account identifiers; online identifiers after consent | US / global | |
| Apple | Optional Sign in with Apple | Apple account identifier, email or relay email | US / global |
| Expo and Firebase (Google) | Push notifications for the mobile app | Device push tokens, notification content | Global |
| Cloudflare Turnstile | Bot protection on public forms | IP address, browser signals | Global |
| Better Auth | Sign-in security and account protection | IP address, device signals, account identifiers | Global |
| Meilisearch | Workspace search index | Searchable workspace records (customers, jobs, estimates) | Per deployment |
| PostHog | Product and website analytics, only after you accept cookies | Online identifiers, pages and feature-usage events | EU |
| Sentry | Error monitoring; session replay only after you accept cookies | Error context, IP address, user and workspace IDs; masked replays | EU or US (project setting) |
| Meta Platforms | Pixel and Conversions API, only after you accept cookies (not under GPC) | Online identifiers, click IDs, hashed email | US / global |
Material changes
We will update this page and, for Account Owners under a DPA, aim to give at least 14 days’ notice before a new subprocessor processes Customer Data (except urgent security replacements).
Questions: info@jomioz.com