Legal
Sub-processors
Provider categories and change notice
Referenced in Privacy Policy Section 7 and Master Subscription Agreement Section 4.2
On this page
1. How We List Providers
We use third-party providers to run the Service. We require each one by contract to process personal information only to perform the Service for us and to protect it with appropriate security. We do not name them in our public documents. Our Customers receive the full list, with data categories, purposes and locations, in our confidential Data Processing Addendum. Recipients can ask us which categories handle their data at privacy@b2bautoloop.com (Privacy Policy Section 7).
We maintain this public list of the general technology categories used in the Service (Master Subscription Agreement Section 4.2). The Data Processing Addendum identifies each sub-processor that processes a Customer's personal data, with data categories, purposes, processing locations and retention, and is provided to Customers under confidentiality.
2. Provider Categories
| Provider category | What it handles |
|---|---|
| AI video and voice | Presenter rendering, lip-sync, voice synthesis and speech-to-text |
| Language processing | Research summaries, script and email writing, and on-page conversation replies |
| Live conversation | Real-time audio and avatar transport for on-page conversations. Real-time media may be routed through a provider's global network, live-avatar providers may process data outside the United States, and we do not record the media |
| Email and text delivery | Sending mailboxes and domains, email delivery, and text messages to people who asked for them. Text messaging is processed primarily in the United States |
| Business data | Company signals and business email lookup and verification. Some lookup providers are established or host data in the EU or UK. We send them only the name, company and domain of U.S. business contacts |
| Identity verification | Identity and liveness checks for Digital Twin setup and account provisioning |
| Hosting and delivery | Database, GPU computing, content delivery and encrypted backups. Global edge delivery may serve pages and video from locations outside the United States |
| Analytics | Page and video engagement measurement |
| Payments | Stripe, for billing and card payments |
Encrypted backups are stored in a bucket created with the provider's United States jurisdictional restriction; providers may process account and network metadata elsewhere. Customers are responsible for having a lawful basis to contact their recipients and for not targeting EEA, UK or Swiss recipients. This list changes whenever a category is added.
3. 30-Day Change Notice
We give at least 30 days' notice before a new sub-processor handles Customer data, or before we replace one. We update the confidential Data Processing Addendum and email subscribed Customers. BAL may change rendering providers, and any change follows this same notice (Privacy Policy Section 7).
A shorter notice may be given only where needed to keep the Service available or secure or to comply with law, in which case we give notice as soon as practicable and the objection right below still applies (Master Subscription Agreement Section 4.3).
4. Objection
A Customer may object within 30 days of notice on reasonable grounds relating to data protection. If the parties cannot resolve the objection in good faith within a reasonable period, the Customer's sole and exclusive remedy is to terminate the affected portion of the Service without penalty and receive a pro-rated refund of prepaid, unused fees (Master Subscription Agreement Section 4.3; Data Processing Addendum Section 2.2).
5. What We Require of Providers
We impose data protection obligations on each sub-processor that are substantially similar to those we owe our Customers, and we remain liable to the Customer for each sub-processor's acts, errors and omissions to the same extent we would be liable if we had performed the sub-processor's services directly, subject to the liability cap in the Master Subscription Agreement (Master Subscription Agreement Section 4.4; Data Processing Addendum Section 5.2).
We maintain reasonable technical and organizational measures appropriate to the risk, including row-level security for tenant data isolation within our multi-tenant database, encryption in transit, and access controls. We notify a Customer of a confirmed security incident affecting Customer Data without undue delay and in no event later than seventy-two (72) hours after we become aware of it (Master Subscription Agreement Section 4.5).
6. What Providers Receive
Stock-presenter videos may be rendered by BAL or by third-party rendering providers that act as our service providers. We send a rendering provider only the script audio and the stock presenter image. We do not send recipient email addresses, and we give a provider no right to use what we send beyond rendering the clip for us (Privacy Policy Section 5).
Digital Twin face and voice data is processed only on infrastructure that BAL controls, in specific United States data centers that we will pin for this work before any Digital Twin processing begins, and is never sent to the third-party providers that render stock-presenter videos. The only exceptions are the identity and liveness check, which an identity verification provider performs, and the optional image tool, which needs the person's separate, express agreement (Privacy Policy Section 6.2).
7. Contact
Questions about sub-processors: privacy@b2bautoloop.com. Legal notices: legal@b2bautoloop.com.