orb22 Subprocessors
Draft
Last updated: September 30, 2026
DSBC LLC ("DSBC", "we") uses the service providers below to run orb22. Each one processes personal data only to provide its service to us, under written data protection terms. This list is part of our Data Processing Addendum and is described in our Privacy Policy. We give at least 30 days' notice by email to account owners before adding or replacing a subprocessor, as set out in the DPA.
Subprocessors for Visitor data
| Provider | What it does for orb22 | Data involved | Location | Retention by provider |
|---|---|---|---|---|
| Cloudflare, Inc. | Hosting, database, key-value storage, and network security for the builder, the widget, hosted pages, and the API. | Customer account data, agent settings and knowledge, Visitor transcripts and call records, AI call summaries, purchase records matched to calls, abuse limit counters (including IP addresses). | Global (Cloudflare network). Database primary location: eastern North America. | As we set: transcripts, summaries and purchase records 90 days, counters 2 days, backups up to 30 days. |
| OpenAI, L.L.C. | Real-time voice conversation (speech recognition and speech generation). | Visitor voice audio, streamed in real time and not stored by us; the agent's instructions and knowledge; the spoken conversation. | USA | Up to 30 days for abuse monitoring. Not used for training. |
| Anthropic, PBC | AI text: knowledge import from websites and files, answers from the knowledge during a call, answer extraction, AI call summaries (labeled as AI in the builder), and written assessments. | Website pages and files the Customer imports; Visitor transcripts and answers; for summaries, call details such as the length, what was shown or clicked, and whether a purchase was recorded. | USA | Up to 30 days, longer only for usage policy violations. Not used for training. |
| Composio, Inc. | Only when a Customer connects an app in Integrations: connects the app the Customer chooses (Klaviyo, Mailchimp, HubSpot, Brevo, ActiveCampaign, Pipedrive, Salesforce, Zoho CRM or Google Sheets) and delivers leads to it on our behalf. Keeps the Customer's sign-in to that app (access tokens or API keys); orb22 does not store them. | Visitor email address and name if given; whether the Visitor ticked the marketing opt-in; the agent's name and the call's source; the AI summary's bottom line, outcome and lead temperature; purchases matched to the call (order number, value, currency). | USA | Under Composio's terms. |
The widget's fonts are served by orb22 itself, from Cloudflare. No font provider receives Visitor data.
Product catalogs: when a Customer scans its website for products, orb22 reads only the public product pages and product lists of the Customer's own website (names, prices, images, descriptions, stock). This is public business data, not personal data, and is stored with the agent on Cloudflare.
Purchase tracking: when a Customer turns it on, the Customer's own website or shop platform (for example a Shopify custom pixel or Shopify's order webhook, set up by the Customer) sends orb22 the order number, total, currency, and discount codes of an order, with the call reference and visitor ID the widget stored on the Customer's website, and an email address only as a one-way hash. orb22 stores only purchases that match a call, on Cloudflare. The Customer's shop platform is chosen by the Customer and is not our subprocessor.
DSBC personnel
DSBC staff and contractors who provide support, security, and engineering may access personal data from the United States and Israel, under confidentiality obligations and only when needed. Israel has an adequacy decision from the European Commission.
Integrations you turn on
These providers receive data only when a Customer connects them to an agent. They are recipients chosen by the Customer, not our subprocessors, and the Customer's own contract with the provider governs the data once it is delivered.
| Provider | What it does | Data involved | Location |
|---|---|---|---|
| The apps you connect, in your own account (Klaviyo, Mailchimp, HubSpot, Brevo, ActiveCampaign, Pipedrive, Salesforce, Zoho CRM, Google Sheets) | Receive each lead the agent collects, through Composio, in the Customer's own account. A marketing subscription (a Klaviyo list with consent, Mailchimp "subscribed", a Brevo or ActiveCampaign list) is made only when the Visitor ticks the separate opt-in box on the email card, which is unticked by default. Without the tick: a contact or lead that is not a marketing subscription (a Klaviyo profile, a Mailchimp "transactional" contact, a CRM contact or lead, a Google Sheets row marked "no"), and nothing is sent to Brevo or ActiveCampaign. The Customer must have the Visitor's marketing consent. | Visitor email address and name if given, whether the Visitor ticked the opt-in, the agent's name and the call's source; later the AI summary's bottom line, outcome and lead temperature, and purchases matched to the call, as notes. | Chosen by the Customer |
| Klaviyo, Inc. (with only a public API key, without connecting) | Sends the email address a Visitor types to the Customer's Klaviyo account as an email subscription to the list the Customer chose, only when the Visitor ticks the opt-in box. Other email addresses are not sent to Klaviyo. | Visitor email address and the agent's name. | USA |
| Customer webhook | Sends call results to an address the Customer chooses. Only when the Customer turns it on. | Call details, answers, name and email address if given and, when a call ends, the transcript; the AI summary once it is written (marked as AI generated); purchases matched to the call. | Chosen by the Customer |
Providers for our own account data
These providers process Customer account data for which DSBC is the controller. They do not receive Visitor data.
| Provider | What it does | Data involved | Location |
|---|---|---|---|
| Stripe, Inc. | Payments and billing for Customer subscriptions. | Billing contact, payment details, invoices. | USA and global |
Questions
Email support@22floor.com. To get notices of changes to this list, make sure your account owner email is current.