Sub-processors
Last updated: October 2, 2026
Who these are
Some of the work VooVr does — turning speech into text, generating a draft summary, sending a verification code, encrypting a field — is handled by specialist companies rather than by us. We call them sub-processors.
Each one processes data only to perform the specific job we have configured, on our instructions. We do not give our sub-processors permission to use your data for their own purposes, and we do not sell it.
The full list
Everything below is in our current codebase. “Default” means the provider used when you have not configured an alternative. “Optional” means you have to turn it on before it receives anything.
Data regions: we're confirming exact regions with each provider. Ask us and we'll share what we know today.
| Provider | Purpose | Data received | Status |
|---|---|---|---|
| DeepSeek | Conversation analysis and draft notes | The transcript text of a meeting or voice note. For the periodic drift check, also previously derived scores and session dates. | Default |
| OpenAI | Speech-to-text; OCR for uploaded documents and images | Audio files you submit for transcription. Images or documents you submit for text extraction. | Default |
| Text-to-speech for read-aloud playback; Cloud KMS key wrapping for field-level encryption | The text to be spoken, for synthesis. For KMS, key and encryption metadata — not record contents. | Default | |
| Deepgram | Alternative speech-to-text and text-to-speech | Audio files you submit for transcription; text submitted for synthesis. | Optional |
| Gemini | Alternative text-to-speech | The text submitted for synthesis. | Optional |
| Brevo | Transactional email: verification codes and reminders | The recipient email address and the content of the message being sent. | Default |
| ipinfo.io | Backup lookup for approximate location when our local database has no result. | The IP address at sign-in. | Default |
| Meta | WhatsApp Business messages: verification codes and reminders | The phone number you provide and the content of the message being sent. | Optional |
| MongoDB | Primary database | The full application record set: profiles, meeting records, transcripts, notes, reminders and audit events. | Default |
| Sign in with Google (OAuth) | Your Google account identifier, name and email address, returned by Google at sign-in. | Optional | |
| Google Fonts | Delivering this website's fonts | The network request your browser makes to the font CDN, including your IP address. No VooVr account data is sent. | Default |
Approximate location is looked up first on our own servers using the DB-IP Lite database. Your IP address is sent to ipinfo.io only if that lookup has no result.
We do not use advertising or analytics trackers, and no analytics or advertising company appears in this list.
What conversation analysis receives
When a meeting transcript or voice note is analysed, the text of that conversation is sent to the configured language model provider so it can produce a summary, action items and follow-up drafts.
For a normal analysis request, the text sent does not include names, email addresses, phone numbers, employee IDs, department labels, IP addresses, document contents or any credentials.
Two things worth knowing: if you have a meeting recording, the audio file is sent to the transcription provider to be turned into text. And the periodic drift check is a separate request that also includes earlier derived scores and session dates, so the model can compare them over time.
Storage and encryption providers
Application records are stored in MongoDB. Selected personal fields are encrypted at the field level with AES-256-GCM using per-record keys that are wrapped with Google Cloud KMS. Transcripts and audio files are held in the database and in local file storage; they are protected by transport encryption and by access controls, but they are not individually field-encrypted.
International transfers
Several of the providers above process data outside your country of residence, including DeepSeek for conversation analysis. Where data is transferred abroad, it is transferred under the provider's own contractual terms and data-protection commitments. We keep the scope of what is shared narrow so that less data leaves your environment, and we do not share fields that are not needed for the task at hand.
Changes to this list
We review this list whenever we add, remove or change a provider. The “Last updated” date at the top of this page shows when it last changed. If you have questions about a provider listed here, contact us and we will explain what is sent and why.
Contact
Questions about sub-processors, or about any data we hold about you, email voovrhr@gmail.com. Our Privacy Policy explains how to request a copy or deletion of your data.