Data Sub-Processors

Fonema Inc.
Last updated: March 30, 2026

1. Introduction

Sub-processors are third-party vendors that Fonema employs to process personal data on behalf of our clients. As an AI voice platform, Fonema relies on multiple sub-processors to:

• Telephony Infrastructure: call routing, voice connectivity, and data transmission
• AI Processing: language models for speech-to-text transcription, response generation, and text-to-speech synthesis
• Cloud Storage: secure hosting of call recordings, client configurations, and platform data

This page lists all of Fonema's current sub-processors and explains how we notify changes.

2. Notification Mechanism

Fonema will notify all clients at least 30 days prior to:

• Add a new sub-processor
• Change the location or functions of an existing sub-processor
• Change a sub-processor's access level to personal data

Notifications will be sent via email to the compliance/legal contacts registered in the client's account.

3. Objection Mechanism

If a client objects to a new sub-processor, they may:

1. Notify in writing to legal@fonema.ai within 15 days of the notification.
2. Explain the basis for the objection.
3. Fonema will attempt to resolve the objection in good faith.

If the objection is not resolved:

• The client may terminate the affected services without early termination penalty.
• Termination will be effective at the end of the current billing cycle or as agreed.

If the client continues to use the services after the 15-day period, they are deemed to accept the new sub-processor.

4. Current Sub-Processors

5. Sub-Processor Details

5.1 Twilio Inc.

Purpose: Twilio provides the fundamental telecommunications infrastructure that enables Fonema to route calls, connect to local telecom operators, and maintain real-time voice connectivity.

Data Processed:

• Phone numbers (origin and destination)
• Call routing data
• Call metadata (start/end timestamp, duration, connection status)
• Caller and recipient information
• Country/region information for optimal routing

Location: Servers in multiple US regions based on caller proximity

Agreements: Twilio operates under a separate Data Processing Agreement (DPA) available at https://www.twilio.com/legal/dpa

5.2 Vonage (Ericsson)

Purpose: Vonage acts as an alternative telecommunications infrastructure provider, offering redundancy and routing options to enhance reliability and global coverage.

Data Processed:

• Phone numbers (origin and destination)
• Call routing data
• Call metadata (start/end timestamp, duration, connection status)
• Call availability and quality information

Location: Global servers with primary data centers in the United States and Europe

Agreements: Vonage operates under a separate DPA available at https://www.vonage.com/legal/privacy/

5.3 OpenAI

Purpose: OpenAI provides large language models (LLMs) which Fonema uses to process user input, generate conversational responses, and analyze user intent in real-time.

Data Processed:

• Conversation transcripts (text/voice)
• Agent configuration prompts
• Contextual data for response generation
• Sentiment and intent analysis

Location: United States (processed on OpenAI servers)

Important Policies:

• Processed data may be used by OpenAI to improve models (per its Usage Policy). Fonema can request to opt-out of model improvement in enterprise settings.
• OpenAI maintains its own Privacy Policy available at https://openai.com/privacy/

Agreements: OpenAI's DPA applies per its terms of service: https://openai.com/policies/business-terms

5.4 Anthropic

Purpose: Anthropic provides alternative language models (Claude) that can be used as a complementary or primary LLM option for conversation processing.

Data Processed:

• Conversation transcripts (text/voice)
• Agent configuration prompts
• Contextual data for response generation
• Conversational analysis

Location: United States (processing on Anthropic's infrastructure)

Important Policies:

• Anthropic does not use customer data for model training without explicit consent
• Data is processed in accordance with rigorous privacy standards
• Anthropic maintains a Privacy Policy available at https://www.anthropic.com/privacy

Agreements: Anthropic's DPA applies per terms of service

5.5 Amazon Web Services (AWS)

Purpose: AWS provides scalable cloud infrastructure including database storage, object storage for recordings, and application hosting.

Data Processed:

• Call recordings (audio files in S3)
• Call transcripts
• Client and agent configurations
• End-user data (numbers, profiles, history)
• Platform audit and event logs
• Behavioral analysis and reports

Primary Location: us-east-1 (Virginia, USA). Enterprise clients can request replication to other regions (us-west-2, eu-west-1, etc.)

AWS Services Used:

• Amazon RDS (relational databases for configurations and metadata)
• Amazon S3 (call recording storage)
• Amazon EC2 (application processing)
• AWS Lambda (serverless processing)
• Amazon CloudWatch (monitoring and logging)

Agreements: AWS operates under an enterprise DPA available at https://aws.amazon.com/legal/aws-dpa/

6. International Data Transfers

Some sub-processors (OpenAI, Anthropic, AWS) operate in the United States. Processing in the United States:

• Fonema has assessed that these transfers are necessary for the platform's functionality
• Technical and contractual safeguards are implemented (encryption, limited access, data protection clauses)
• Clients in the EU/EEA must comply with International Data Transfer requirements under GDPR
• For clients in the EU, Fonema can execute Standard Contractual Clauses (SCCs) with sub-processors as needed

7. Audit and Compliance Rights

Enterprise clients and clients in jurisdictions with strong data regulations have the right to:

• Request sub-processor compliance certifications (SOC 2, ISO 27001, etc.)
• Conduct compliance audits with privacy regulations (GDPR, CCPA, LGPD, etc.)
• Request security and data protection assurances

For audit requests, contact: legal@fonema.ai

8. Changes to Sub-Processors

Change History:

9. Contact for Sub-Processor Matters

For questions, objections, or requests related to sub-processors:

Email: legal@fonema.ai
Subject: "Sub-Processor Inquiry"

10. Glossary

• Sub-Processor: Third party that processes personal data on behalf of a data controller or processor
• DPA (Data Processing Agreement): Contractual agreement defining data processing terms
• International Data Transfers: Movement of personal data between jurisdictions
• SCCs (Standard Contractual Clauses): EU-approved clauses for international data transfers

Note on entities: These terms are issued by Fonema Inc. For clients in Mexico contracting through Fonología, S.A. de C.V., the specific conditions set forth in Annex D of the Master Services Agreement apply.