Who we share data with

Every supplier that handles personal data for DailyChinwag, what each receives and why. None may use members’ or residents’ voices, words or notes to train any model. That is a term of our agreement with each. We give care homes at least 30 days’ notice before adding a supplier that would receive residents’ data.

Suppliers that receive data

• Supabase

  Everything we hold: residents' details, consent, notes, concerns, the portal

  For: Database and sign-in · Where: London (AWS eu-west-2) · May train on it? n/a

• ElevenLabs

  The call itself: her voice as audio, what is said, and what the companion was told before the call

  For: The companion's voice and hearing · Where: United States · May train on it? No, in their terms; our written clause is being filed

• Twilio

  Telephone numbers and the call in transit

  For: Placing the calls · Where: EU routing · May train on it? No

• Anthropic

  The transcript text, to check for anything worrying and to write the note

  For: Safety classification and the daily note · Where: United States · May train on it? No: commercial API terms (no training on API data)

• Resend

  Emails to families, staff logins, and emails families send to hello@

  For: Email · Where: Ireland (AWS eu-west-1) · May train on it? No

• Stripe

  The home's billing contact and card

  For: Payments · Where: Global · May train on it? No

• Cloudflare

  Email routing for hello@ and our domain

  For: Email receiving and DNS · Where: Global edge · May train on it? No

• Sentry

  Error reports with personal details removed before they leave

  For: Fault monitoring · Where: EU · May train on it? No

Hosting

Our software runs here; data passes through and is not stored by them.

• Fly.io

  The engine that places calls runs here; nothing is stored

  For: Hosting (engine) · Where: London · May train on it? n/a

• Vercel

  The website and this portal run here; data is read per request

  For: Hosting (web) · Where: Global edge, EU functions · May train on it? n/a

Set up but not in use

Listed so there are no surprises: these receive nothing today and would be moved to the first table, with notice, before they ever did.

• Vapi · LiveKit · Telnyx

  Nothing. Set up in code as a fallback; no contract, no data, no calls

  For: Voice/telephony fallback (not in use) · Where: – · May train on it? –

Where it goes, and for how long

For each supplier that receives data: the legal mechanism under which it may leave the UK, and how long the supplier keeps it. Our voice provider keeps call audio for 360 days; that is the figure in our privacy notice and it will change here first if it changes. The signed data-processing agreements behind this table are available to a care home on request.

• Supabase

  Transfer: No transfer: stored in the UK (London). Supplier support access from outside the UK is covered by uk addendum to the eu standard contractual clauses (in the supplier's data-processing agreement)

  Kept for: For as long as our retention policy says, then deleted by our code; point-in-time backups kept for a short rolling window

• ElevenLabs

  Transfer: UK Addendum to the EU standard contractual clauses (in the supplier's data-processing agreement); processor-to-processor module where a care home is the controller

  Kept for: Call audio and transcript 360 days, then deleted. The public demo line (the number on our website) has no retention limit set yet; we are setting it to 30 days and will update this line when done

• Twilio

  Transfer: Calls routed within the EU; account data under uk addendum to the eu standard contractual clauses (in the supplier's data-processing agreement)

  Kept for: Call records (numbers, times, duration) for the life of the account; no call audio is recorded by Twilio

• Anthropic

  Transfer: UK Addendum to the EU standard contractual clauses (in the supplier's data-processing agreement)

  Kept for: Transcript text is used only to answer our request; under the commercial API terms it is not used for training and is deleted by the supplier within 30 days

• Resend

  Transfer: No restricted transfer: UK adequacy regulations cover the EEA (Ireland); supplier's uk addendum to the eu standard contractual clauses (in the supplier's data-processing agreement) for any US access

  Kept for: Email content and delivery logs for a limited period set in the supplier's console; our outbox keeps its own copy under our retention policy

• Stripe

  Transfer: Contracted with Stripe's UK entity; onward transfers under Stripe's own data-transfer terms (SCCs and UK Addendum)

  Kept for: As required by financial-records law (typically 6 years)

• Cloudflare

  Transfer: UK Addendum to the EU standard contractual clauses (in the supplier's data-processing agreement)

  Kept for: Email routing metadata only, short-lived

• Sentry

  Transfer: No restricted transfer: UK adequacy regulations cover the EEA (EU region)

  Kept for: Error events 90 days; personal details are removed before they leave us

Changes

• 15 Oct 2026: List published in the portal and at /privacy/sub-processors.
• 13 Oct 2026: Resend now also receives emails families send to hello@ (support inbox). Fly.io: second engine machine, same London region.
• 13 Oct 2026: Vapi, LiveKit and Telnyx listed as 'not yet': scaffolded as fallbacks, no data.
• 13 Aug 2026: Register created: Supabase, ElevenLabs, Twilio, Anthropic, Resend, Stripe, Cloudflare, Sentry, Fly.io, Vercel.

Questions: hello@dailychinwag.co.uk. Our privacy notice covers what we hold and for how long.