DRAFT — NOT LEGAL ADVICE, NOT IN FORCE. This document was prepared by an AI assistant from this repository's source code. It has not been reviewed by a lawyer. It must be reviewed by counsel qualified in every jurisdiction in which the Service is offered before it is published or relied on. Nothing here is a commitment by anyone.
Document version: draft-1 · Prepared: 2026-08-07 · Status: unreviewed
Terms used here have the meanings given in the . "We", "us" and "the Service" mean [LEGAL ENTITY NAME]'s hosted offering.
This is the list of third parties that may Process Customer Personal Data on our behalf when you use the hosted Service.
It does not apply to a self-hosted install. The software is MIT licensed. If you run it yourself, you choose your own database host, your own model provider and your own optional API keys, and you — not us — are responsible for listing them to your own customers. See §2.
Two lists follow, and the split is deliberate:
§5 lists third parties named in the codebase that are not built and receive
nothing. They are listed so that reading .env.example does not create a
false impression.
The hosted Service is deployed one instance per Customer, each with its own Postgres database. There is no shared multi-tenant datastore. Consequently:
This reflects the architecture recorded in docs/plan/multi-tenancy.md §B.9 and
docs/product/connectors.md §2 as at the date above. If the hosted Service
moves to a shared multi-tenant database, this document must be reissued and
notice given under §6.
Which model runs the agent is a runtime setting, not a fixed dependency. It
is stored in AppSetting.agentModelId and chosen by a workspace administrator
from a catalogue fetched live from the gateway.
That means the identity of the company receiving contact names, call notes and LLM-written briefs about named individuals can change without a deployment.
Two ways to resolve this, and the Customer must be told which applies:
[DECISION REQUIRED — A or B. This draft assumes Option A and leaves the provider list to be filled once the catalogue is fixed.]
Model training. Whether any provider uses inputs or outputs to train models
is governed by that provider's own terms, not by this software.
[VERIFY EACH PROVIDER'S CURRENT PUBLISHED POSITION AND CITE IT HERE BEFORE
PUBLICATION — see docs/legal/research.md §4.] Do not state a blanket "we do
not train on your data" position: it is not ours to give.
Agent session state. The agent framework (eve) persists conversation
continuation state outside the application database.
[UNRESOLVED — establish where that state is stored and under whose terms, and
list the operator here before publication.]
docs/telemetry.md is the complete account and the code matches it. Once a day
the API sends counts keyed to a random install UUID:
identify() is never called and no person profile is ever created
($process_person_profile: false).$ip: null, geoip is disabled, and the receiving project
has anonymize_ips enabled — three independent measures.CRM_TELEMETRY_DISABLED=1 or DO_NOT_TRACK=1, and
during test runs.It is listed for completeness and because it is a third party in the deployment, not because it receives Customer Personal Data.
Each of these is off unless an API key is configured. A missing key removes the capability and never causes an error.
The LinkedIn capability uses a third-party scraping API, not an official
LinkedIn API. .env.example states the reason: there is no official LinkedIn or
Sales Navigator API available to obtain, and LinkedIn's terms prohibit storing
their content obtained outside their own APIs, including indirectly.
It is off by default. Whether enabling it is acceptable is a decision for the party operating the install, and the place that risk on the Customer. We do not enable it on a Customer's behalf without a written instruction.
.env.example contains a section headed "Scaffolding: connectors that are not
built", which opens by stating that everything above that line is read by some
code and nothing below it is. As at the date of this document these are:
Zoho CRM · HubSpot · Salesforce · Gong · Apollo · Slack · Fireflies · PostHog (as an MCP data source, distinct from the telemetry use in §3.2)
Setting any of these variables today changes nothing: no code reads them, no capability appears, and the integrations page says so and disables its own connect action.
They are listed here so that a reader who greps the repository and finds
ZOHO_CLIENT_ID does not conclude that Zoho is a sub-processor. Each becomes
one on the day it is built, and this document must be updated with notice under
§6 before that connector is shipped to any Customer.
We will give Customers [NOTICE PERIOD — 30 days recommended] written notice before adding a new Sub-processor or replacing an existing one, by [NOTIFICATION MECHANISM — e.g. email to the workspace owner and an RSS feed on this page].
A Customer may object on reasonable data-protection grounds within [OBJECTION WINDOW — 15 days recommended]. If we cannot make the change avoidable for that Customer, the Customer may terminate the affected part of the Service without penalty and receive a pro-rata refund. This mirrors DPA §[X].
Emergency replacement of a Sub-processor for security or continuity reasons may happen with shorter notice; we will notify [TIMEFRAME] afterwards.
Subscribe to changes: [MECHANISM].