Sub-Processors

Last Updated: May 3, 2026

Worxflow ("we") engages the third-party service providers listed below ("sub-processors") to help deliver the Worxflow Platform. Each sub-processor is contractually required to process personal information only on our documented instructions, maintain reasonable security measures, and not use the information to train general consumer AI models or any other unrelated purpose.

How we keep this list current

We post material changes to this list on this page at least 30 days before the change takes effect. To receive change notifications by email, contact hello@worxflow.io with the subject line "Sub-Processor Notifications."

Sub-Processor Directory

The following providers may have access to personal information collected through the Platform. 5 of them publish a Data Processing Addendum publicly; the others are bound by equivalent contractual terms in their service agreements with us.

Provider	Purpose	Data Processed	Location	DPA
Telnyx LLC	Telephony — voice call routing, SMS delivery, call recording, and inbound/outbound message API	Caller phone numbers, call audio (recordings), SMS message content, delivery receipts, and metadata necessary to deliver communications.	United States	View →
Anthropic, PBC	AI inference — real-time service-advisor coaching and call summarization (Claude API)	Call transcripts and summary text. Anthropic does not retain commercial-API content beyond 7 days for abuse monitoring and does not train its models on this data.	United States	View →
Groq, Inc.	AI inference — speech-to-text transcription of call audio (Whisper)	Call audio segments. Processed transiently for transcription; no long-term retention.	United States	View →
OpenAI, L.L.C.	AI inference — fallback transcription (Whisper) when primary provider is unavailable	Call audio segments and short text completions. OpenAI does not train its models on commercial-API data.	United States	View →
Stripe, Inc.	Payment processing — credit-card and bank-account transactions	Cardholder data, billing address, transaction amount, payment confirmation tokens. Cardholder data is collected and tokenized directly by Stripe; we do not store full card numbers.	United States	View →
Astria, Inc.	AI image generation — vehicle and brand-asset image creation	Reference images and text prompts submitted by staff. No customer personal information.	United States	In service agreement
Replicate, Inc.	AI image generation — model inference for portrait and asset variants	Reference images and text prompts. No customer personal information.	United States	In service agreement
Segmind Inc.	AI image generation — Flux Kontext compositing	Reference images and prompts. No customer personal information.	United States	In service agreement
GIPHY (Meta Platforms, Inc.)	Animated-image search for in-app messaging	Search query strings. No customer personal information.	United States	In service agreement
TekMetric (FullStack Auto, Inc.)	Shop-management-system integration (where the shop uses TekMetric)	Customer name, contact information, vehicle records, repair-order data — for the limited purpose of synchronizing shop data with our portal.	United States	In service agreement
PitCrew (Auto Industry Tools)	Shop-management-system integration (where the shop uses PitCrew)	Customer and repair-order data, where applicable.	United States	In service agreement
AutoOps, Inc.	Online appointment scheduling	Appointment requests submitted via the public booking embed.	United States	In service agreement
Vultr Holdings, LLC	Cloud infrastructure hosting	All Platform data, encrypted at rest and in transit. No data is processed by Vultr beyond hosting our application servers and storage volumes.	United States	In service agreement

Audio Processing & AI Disclosure

Inbound and outbound voice calls placed to or from numbers managed on the Platform may be recorded and processed in real time by AI providers listed above (Anthropic, Groq, and as a fallback OpenAI). Each caller is given audible notice of recording and AI processing at the start of every call. None of these providers retain recordings or transcripts beyond what is contractually required for service delivery, and none of them use this audio to train general-purpose AI models.

SMS Delivery

Outbound and inbound text messages are routed exclusively through Telnyx LLC. We do not share recipient phone numbers with any third party for marketing or analytics purposes. National Do-Not-Call list scrubbing is performed against publicly registered DNC entries on a 31-day cycle.

Data Residency

All sub-processors listed above process data on infrastructure located within the United States. Where a sub-processor offers EU-resident processing, we have not opted in — the Platform is not currently marketed to or designed for EU/UK consumers.

Tenant-Level Sub-Processors

If you interact with a specific shop using the Platform under the shop's own brand (for example, a repair-order portal or appointment-booking page), that shop may engage additional sub-processors of its own (such as a different shop-management system, a financing provider, or a marketing tool). Those sub-processors are disclosed by the shop in its own privacy notice, not here.

Questions

For questions about this list, to request the contractual data-protection terms applicable to a specific sub-processor, or to subscribe to change notifications, contact hello@worxflow.io.

This list was last updated on May 3, 2026. Material changes are announced on this page at least 30 days in advance.

Legal