esek.io provides its service to businesses ("Customers"). When a Customer uses esek.io, the Customer is the controller of the personal data of its own customers, such as messages, calls and contact details ("Customer Data"), and esek.io processes that data on the Customer's behalf. This page lists the third parties that may process Customer Data for us. Customer Data is hosted in the United States. Transfers from the EU, the EEA and the UK rely on the EU-US Data Privacy Framework and Standard Contractual Clauses. How we handle personal data more broadly is described in our Privacy Policy.
1. Sub-processors
These providers process Customer Data on our behalf, only to deliver the service.
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Google Cloud Platform | Hosting, database, file storage, and push notifications (Firebase Cloud Messaging) | All Customer Data | United States (Iowa) |
| Meta Platforms | Sending and receiving WhatsApp, Instagram and Messenger messages, and WhatsApp calls | Messages, media, phone numbers, profile names | Global |
| OpenAI | AI chat replies, the Copilot assistant, and call audio for the AI phone assistant | Message text, conversation history, business context, call audio | United States |
| Google Gemini API | Live call audio for the AI phone assistant, text-to-speech, and voicemail transcription | Call audio, reply text, voicemail recordings | United States |
| Twilio | Phone calls and call recordings, SMS sign-in codes, caller number lookups, and regulatory registration of phone numbers | Call audio, recordings, phone numbers, registration documents | United States |
| DIDWW | Routing inbound calls to the phone numbers we provide | Caller number, dialled number, call status | Ireland |
| Resend | Transactional email | Email addresses, email content | United States |
| Google Cloud Translation API | Translating messages | Message text | United States |
| Google Web Risk | Checking links found in messages for safety | Links (URLs) | United States |
| Google Maps Platform | Looking up business addresses | Addresses | United States |
Location is where the provider processes the data. Where a provider does not publish a fixed processing region, it is the country of the contracting entity.
2. Services for our own account and billing
esek.io uses these services for its own relationship with Customers, such as billing, sign-in and advertising. For this data esek.io is the controller, and these services do not process the Customer Data described above.
| Service | Purpose | Data | Location |
|---|---|---|---|
| Paddle | Merchant of record for subscriptions bought on our website | Billing details, email address | United Kingdom |
| Apple | Sign in with Apple and App Store purchases | Account identifier, email address, purchase records | Global |
| Google Sign-In and Google Play purchases | Account identifier, email address, purchase records | Global | |
| Meta | Measuring our advertising: Conversions API and the Meta Pixel on our website | Hashed email address and phone number, ad click identifiers, page views | Global |
| Google Ads | Measuring our advertising: the Google Ads tag on our website | Ad click identifiers, page views | Global |
The advertising tags on our website load only after consent for visitors in the EU, the EEA and the UK.
3. Integrations a Customer chooses to connect
A Customer can connect its own accounts with the providers below. The Customer chooses the provider and holds its own agreement with it. We pass data to it only on the Customer's instruction.
- Morning (Green Invoice): invoices and receipts (Israel).
- Tranzila: payment processing (Israel).
- Shippo: shipping labels.
- Google Calendar: writing bookings and reading busy times.
- Google Drive: files the user picks.
- Israel's national do-not-call registry: phone numbers are checked against the registry before outbound sales calls.
4. Changes
We update this page before a new sub-processor starts processing Customer Data, and we email the owner of each workspace at least 30 days in advance. To object to a new sub-processor, contact privacy@esek.io. If we cannot reasonably address the objection, the Customer may terminate the affected service.