Legal
Sub-processors
Every company we use to run EveryConvo, where it processes, and how a change gets announced.
These are the companies we use to run EveryConvo. Every one of them is named here, with what it does, where it processes and what makes a transfer out of the EEA lawful. The data processing agreement gives you a general authorisation to our using them, and section 6 of it is the promise this page exists to keep.
Who is listing these
EveryConvo is a service of Tein Brouwer Camera, registered with the Dutch Chamber of Commerce (KvK) under number 54575583, VAT identification number {VAT_NUMBER}, at Oosteinderweg 53C, 1432 AD Aalsmeer, the Netherlands. We remain responsible to you for everything the companies below do with your data.
One detail still to fill in. {VAT_NUMBER} is the legal entity's VAT identification number. It appears in the same block on the privacy statement, the terms and the data processing agreement, and nowhere else.
Sub-processors we engage
Companies we chose, that we have a contract with, and that we remain responsible to you for.
| Company | What it does for us | Contact data it can reach | Where it processes | Transfer basis |
|---|---|---|---|---|
| Supabase (on AWS) | The PostgreSQL database. Everything the product stores lives here | All of it | Frankfurt, Germany (EU) | None needed |
| Railway | The four application containers: the API, the worker, the webhook ingest and the app | All of it, in memory while a request runs | Amsterdam, Netherlands (EU) — europe-west4 | None needed |
| Vercel | Hosting for this marketing site, and DNS for the domain. The site is static, has no login and carries no contact data. Vercel sees visitors' IP addresses | None | Edge locations worldwide, including outside the EEA | Standard contractual clauses in Vercel's data processing agreement |
| Anthropic | Claude, which writes AI replies and recognises intent — only in workspaces that switch on an AI step. It receives your instructions, your knowledge base and the last few messages of that one conversation | Message content, for those workspaces only | United States | Standard contractual clauses in Anthropic's commercial terms, which also state that Anthropic may not train models on customer content |
| Stripe | Subscriptions, payment and invoicing. It holds the card; we never see it | None. Stripe gets your billing details, not your contacts | EU and United States | Standard contractual clauses in Stripe's data processing agreement |
| Resend | Transactional email we send to you: sign-in and reset links, invitations, notifications, the daily digest | None. The recipient is you or your colleague | United States | Standard contractual clauses in Resend's data processing agreement |
| Migadu (Migadu-Mail GmbH) | The mailbox behind the addresses on this site, so that an email you send us arrives somewhere | Only whatever you put in an email to us | Switzerland | The European Commission's adequacy decision for Switzerland. Migadu does not publish which country its datacentre is in |
Platforms you connect yourself
These are not our sub-processors, and the distinction matters. You connect them, under your own agreement with them, to reach people who are already their users. Your messages pass through them because that is what the product is; we could not remove them if we wanted to, and we cannot contract with them on your behalf.
| Platform | What passes through it | Where | What governs it |
|---|---|---|---|
| Meta Platforms — Instagram, WhatsApp | Every message and comment, in both directions | Ireland and the United States | Meta's own terms with you for your connected account, and Meta's standard contractual clauses. Meta keeps its own copy of every message and we cannot delete it |
| Telegram FZ-LLC | Every message through a connected Telegram bot | United Arab Emirates | No data processing agreement exists, and the UAE has no EU adequacy decision. Telegram publishes no processor contract and offers none. Section 7 of the DPA says what that means and asks you to decide before connecting a bot |
Your own endpoints. If you send events to a webhook of your own, or pull data through our API into Zapier, Make or your own code, that is your processing at your address. It is not listed here because it is not ours.
How we announce a change
We will not add or replace a sub-processor quietly.
- We publish the change on this page and email the workspace's address at least 30 days before the new sub-processor can reach any contact data.
- You have those 30 days to object on reasonable data protection grounds. Write to hello@everyconvo.com and say what the objection is.
- We will try to solve it: a different supplier, a different region, or leaving the feature switched off for your workspace.
- If we cannot, you may end the affected part of the service or the whole subscription without penalty, and we refund the unused part of the period you have paid for.
- Saying nothing within the 30 days counts as agreement.
Notice goes to every workspace. There is no list to subscribe to and no box to tick: a customer who never opts in still gets told.
The only exception is a change we have to make immediately for security, and we tell you as soon as we have made it.
Change log
Every change to the table above appears here, newest first.
| Date | Change |
|---|---|
| 24 September 2026 | First published. Added Vercel, Migadu and Telegram, which the earlier privacy statement did not name; filled in Railway's region (Amsterdam) and Resend's (United States); separated the platforms you connect from the sub-processors we engage |
Last updated: 24 September 2026.