NoteFishLast updated 30 September 2026
Sub-processors
These are the companies that process personal data for NoteFish. Each one helps run the service; none of them may use it for advertising. We tell business customers at least 14 days before we add or replace one (see the Data Processing Agreement, section 6).
Providers
| Provider | What it does for NoteFish | Data it handles | Where | Transfer safeguard |
|---|---|---|---|---|
| Render Services, Inc. (USA) | Runs the NoteFish servers | Everything passing through a desk: call audio in transit, text, account data, logs | Servers in Frankfurt, Germany. Render is a US company and may access data from the US | EU-US Data Privacy Framework; Standard Contractual Clauses |
| Supabase Pte. Ltd. (Singapore) | Database | Accounts, settings, voice records (not audio), calls, transcripts and summaries | AWS data centre in the European Union | Standard Contractual Clauses |
| Cloudflare, Inc. (USA) | Domain, secure connections and network protection | IP addresses and traffic passing through | Global network | EU-US Data Privacy Framework; Standard Contractual Clauses |
| OpenAI OpCo, LLC (USA) | Speech recognition and translation | Call audio (live), what is said, translations | United States | Standard Contractual Clauses |
| Hanabi AI Inc., trading as Fish Audio (USA) | Makes the voice clone and speaks translated replies | Voice recording, voice clone, reply text and audio | United States, with processing in Japan | Standard Contractual Clauses |
| Eleven Labs Inc. (USA) | Backup voice clone and speech, used if Fish Audio is unavailable | Voice recording, voice clone, reply text and audio | United States | EU-US Data Privacy Framework; Standard Contractual Clauses |
| Twilio Inc. (USA) | Phone numbers, only for desks that connect one | Phone numbers, call audio and call records | United States | EU-US Data Privacy Framework; Standard Contractual Clauses |
How providers may use data
- OpenAI does not train its models on data sent through its API. It keeps translation requests for up to 30 days to detect abuse, then deletes them; speech-recognition requests are not kept.
- ElevenLabs is only a backup, used when Fish Audio is unavailable. Its terms let it use content to improve its models unless that is switched off for the account, which depends on the plan. We are moving to a plan where it is switched off; until then, this is how ElevenLabs' terms stand.
- Fish Audio's standard terms allow it to use content sent to it to improve its models. We are arranging a data processing agreement with Fish Audio that rules this out; until it is signed, this is how Fish Audio's terms stand.
- Render, Supabase, Cloudflare and Twilio process data only to provide their service to us.
Not a sub-processor: Paddle
Paddle.com Market Limited (United Kingdom) sells NoteFish as our reseller and Merchant of Record. It handles payments, invoices and tax as an independent controller under its own privacy policy. Card details go to Paddle, not to us.
Changes
This list was last changed on 30 September 2026. Earlier versions are available on request from hello@notefish.ai.