Sub-processors
These are the companies that help us run the Shlix AI website and the Shlix IBS service. Each works under a written contract that requires it to protect the information and to use it only to provide its service to us. Those marked “never agency data” support only our website, bookings or demonstrations.
| Provider | Purpose | Location | Data processed |
|---|---|---|---|
| Supabase | Database, file storage and sign-in | United States (AWS us-east-1) | All agency data in the service: tasks, documents, customer and policy details, accounts, audit trail; website contact requests |
| Vercel | Website and application hosting; cookieless visitor statistics on the public pages | Global edge network; application functions in the United States | Requests passing through the app; page, referrer, country and device type for site statistics |
| Anthropic | AI model provider: reading and classifying requests, through its commercial API | United States | The parts of an email a task needs: subject, sender and body up to a fixed length, and text read from attachments the task needs |
| Resend | Sends the agency's replies and notifications by email, when the agency's mailbox cannot send them itself | United States | The outgoing message: recipient, subject, body and any attached document |
| Groq | AI model provider used for demonstrations on sample data only | United States | Sample (invented) data only. Never agency data |
| Cloudflare | DNS and mail routing; Turnstile bot check on the sign-in page, when enabled | Global | IP address and browser signals for the bot check |
| Web3Forms | Delivers website contact requests to our team's inbox | As set out in the provider's terms | What a visitor types into the contact form. Never agency data |
| Calendly | The booking calendar for walkthroughs on the website | United States | Name, email, time zone and any answers a visitor gives when booking. Never agency data |
| Calendar invitations and Google Meet for walkthroughs and support calls | United States and Google's other data center locations | Name and email of invitees, and the call itself. Never agency data unless the agency shares it on a call |
Systems your agency connects
These are not our sub-processors. They are services your agency already uses and chooses to connect, under its own contract with the provider. We reach them only with the access your agency grants, and it can revoke that access at any time.
| Service | What we do with it | Where | Data |
|---|---|---|---|
| Microsoft 365 | The agency's own mailbox, read and answered through Microsoft Graph | The agency's own Microsoft 365 tenant | Email in the connected service mailbox |
| The agency's management system (for example NowCerts) | Looking up customers and policies, and filing finished work, with the agency's credentials | The provider's own hosting | Customer and policy records the work needs |
| Twilio (when the phone channel is on) | The agency's own phone number: voicemail turned into tasks | The agency's own Twilio account | Voicemail recordings and the caller's number |
Changes to this list
We tell agencies using the service at least 30 days before adding a sub-processor that handles agency data, and update this page with the date. An agency that objects can raise it with us before the change takes effect, as set out in its Data Processing Addendum.
To be told about changes, ask to be added to the sub-processor notice list. We use that list for nothing else.