| Owner | For |
|---|---|
| Legal and Compliance | Customers, and anyone assessing Calilio as a supplier |
| Published by | CALILIO PTE. LTD., UEN 202433643W, Singapore |
| Contact | privacy@calilio.com |
A sub-processor is a company we engage to help deliver the Calilio service, which handles personal data on our behalf and therefore on yours.
This page lists all of them. It forms part of our Data Processing Agreement.
We email every customer's account administrator at least 30 days before a new sub-processor starts processing your data. That happens automatically. You do not have to subscribe, ask, or watch this page.
The notice names the company, says what it will do, where it processes data and on what legal basis it receives transfers.
1. How we choose and control them
- We check each one's security and data protection practices before we engage them.
- Every sub-processor is under a written contract imposing the same data protection obligations we owe you.
- We stay fully responsible to you for what they do. If a sub-processor causes a problem, that is our responsibility, not something you have to pursue with them.
- We review the list at least once a year, and whenever we add, remove or change a supplier.
2. Sub-processors for the core service
These are used for every customer.
| Provider | What it does | Data it handles | Primary location |
|---|---|---|---|
| Amazon Web Services | Hosting, databases, file storage, authentication, call transcription and language analysis | All service data, including account details, call recordings, messages and contacts | Singapore, with regional services elsewhere |
| Twilio | Connecting voice calls and delivering text messages | Phone numbers, call and message metadata, message content in transit | United States |
| Chargebee | Subscription management and invoicing | Name, email address, billing address, plan and invoice records | United States |
| Stripe | Payment processing | Payment card details entered directly with Stripe, billing name and address | United States |
| Crisp | Support chat inside the app and on the website | Name, email address, phone number, plan, workspace identifier, and the content of support conversations | France |
| Sentry | Error and performance monitoring | Technical error reports, including the user's IP address | United States |
| Push notifications to the mobile apps, and bot protection on our forms | Device push tokens, IP address, and technical signals used to distinguish a person from a script | United States |
3. Sub-processors for optional features
These are used only if you turn the feature on, or only in the circumstances described.
| Provider | What it does | Data it handles | Primary location |
|---|---|---|---|
| Meta Platforms | WhatsApp business messaging | WhatsApp message content and metadata, sender and recipient numbers | United States |
| Didit | Identity verification where a plan or a regulator requires it | Identity documents you upload, the images within them, and the verification result | United States |
| FingerprintJS | Device fingerprinting at sign-up, to detect fraud and duplicate accounts | Technical browser and hardware characteristics, and a derived device identifier | United States |
| PartnerStack | Crediting partners and affiliates who refer customers | Referral identifiers, and the account created from a referral | Canada |
| hCaptcha | Bot protection on public forms | IP address, browser and device details, and interaction signals on the form | United States |
4. Website analytics and marketing
These run on our public marketing website, not inside the signed-in product. They are set only where you have agreed to the relevant cookie category. Our Cookie Policy names every cookie.
| Provider | What it does | Primary location |
|---|---|---|
| Website analytics, advertising measurement and tag management | United States | |
| Microsoft | Website analytics, session replay on the marketing site, and advertising measurement | United States |
| Meta Platforms | Advertising measurement for Facebook and Instagram campaigns | United States |
| Advertising measurement for LinkedIn campaigns | United States | |
| Mixpanel | Product and website usage analytics | United States |
| Ahrefs | Website traffic measurement | Singapore |
5. Calilio group companies
Calilio operates as a single entity, CALILIO PTE. LTD., registered in Singapore. We have no affiliate or group companies processing customer personal data. If that changes, this section will say so and we will give notice as for any other sub-processor.
6. International transfers
Several sub-processors are outside Singapore, the United Kingdom and the European Economic Area, mainly in the United States.
Where personal data leaves the United Kingdom or the European Economic Area, we rely on recognised safeguards, in this order of preference: the United Kingdom International Data Transfer Addendum, the European Commission's Standard Contractual Clauses, or the provider's certification under the EU-US Data Privacy Framework.
The locations above are each provider's principal place of business. The specific processing regions for your account are set out in the Annex to our Data Processing Agreement, and we will confirm them on request.
7. How to be told about changes
- You are told automatically. We email the account administrator on every affected account at least 30 days before a new sub-processor starts work. There is nothing to sign up for.
- Extra recipients. If your privacy or procurement team should also receive these notices, send the addresses to privacy@calilio.com and we will add them.
- This page. We update it on the same day the notice goes out, and the date at the top changes with it.
If you object. Tell us within the 30-day notice period, with your reason. We will work with you to find an alternative. If no reasonable alternative exists and the change would genuinely harm you, you may terminate the affected part of the service without penalty and receive a refund of the unused prepaid fees.
8. What is not a sub-processor
Database and caching software that Calilio runs itself is not a sub-processor. It is software operating inside our own infrastructure, and the hosting provider that infrastructure runs on is listed above. A sub-processor is a company that handles your data, not a piece of software we operate.
9. How to contact us
| Contact | Details |
|---|---|
| Privacy and data protection | privacy@calilio.com |
| Extra recipients for change notices, or an objection to a new sub-processor | Write to privacy@calilio.com. |
| Registered office | CALILIO PTE. LTD., UEN 202433643W, 14 Robinson Road, #08-01, Far East Finance Building, Singapore 048545 |