—Legal
Subprocessors
The providers that process personal data for Worcia, what each one does, where, and whether it is active yet, plus how clients get notice of changes.
Effective 19 October 2026
A subprocessor is a third party that processes personal data for us. This page lists the providers Worcia uses for its own website, Worcia HQ (our internal CRM) and Worcia Console (our client portal). Each one may use personal data only to provide its service to us.
We mark each provider's status honestly. Active means it processes personal data today. Planned means it will be used, is listed here before it processes any data, and does not process any data yet.
1. Current list
| Provider | What it does | Personal data involved | Where | Status |
|---|---|---|---|---|
| Contabo GmbH | Hosts the virtual private server that runs worcia.com, Worcia HQ, Worcia Console, our database and our self-hosted analytics | All data described in our Privacy Policy | European Union (France) | Active |
| Google LLC (Google Drive) | Offsite storage for backups. Backups are encrypted with GPG (AES-256) on our server before upload, and Google does not hold the key, so it cannot read them. | Encrypted backup files only | United States and other countries where Google stores Drive data | Active |
| Zoho Corporation (Zoho Mail) | Hosts our mailbox, hello@worcia.com (opens in a new tab), and sends and receives our email: replies from our team, automatic replies, confirmations, reminders and notifications, and, with consent, newsletters | Names, email addresses, and the content and attachments of email sent to or from us | United States (Zoho's US data center) | Active |
| WhatsApp (Meta Platforms) | Our main phone and WhatsApp line, +1 415 605 2585: calls and messages you send us | Your phone number, messages, call history and anything you share | Meta's data centers, including the United States | Active |
| Zoho Corporation (Zoho Bookings or Zoho Calendar) | Booking page for Growth Calls | Name, email address, chosen time and any notes you enter | Named here before use | Planned: listed here before it processes any data |
| Voice platform (to be named) | Runs voice conversations for the live demo and our phone line | Call audio, phone number, transcripts | Named here before use | Planned: listed here before it processes any data |
| Anthropic, PBC (Claude API) | Would generate answers for our site assistant (Ask Worcia) and outlines for the Automation Sketch tool. Today both run on our own server with automated answers and no AI provider. | The questions you ask; for Automation Sketch, the task you describe | United States | Planned: listed here before it processes any data |
| Language-model provider for the live voice demo (to be named) | Generates responses during live voice demo calls | Call transcripts | Named here before use | Planned: listed here before it processes any data |
| Cloudflare, Inc. (Turnstile) | Checks that forms are sent by people, not automated scripts | Browser and device signals, IP address | Named here before use | Planned: listed here before it processes any data |
| Payment processor, if used (to be named) | Hosted payment page linked from invoices | Payer name, email address and payment details, collected by the processor directly. We never store card data. | Named here before use | Planned: listed here before it processes any data |
When we name a planned provider, we will add its legal entity, where it processes data, the transfer safeguard we rely on, and whether it keeps data for its own purposes, such as abuse monitoring.
2. Providers in client engagements
For systems we build for clients, providers are chosen for each engagement and named in the client's Engagement Agreement. Where a provider is contracted directly in the client's own name, such as the client's CRM, telephony or AI provider account, it is the client's processor, not ours. Our Data Processing Addendum covers how we use subprocessors for client data.
3. How we choose providers
Before we add a provider, we check what data it needs, where it processes it, how it secures it, and whether its terms allow it to use the data for its own purposes. For AI providers, we use API or business terms under which the data we send is not used to train their models. We put a written contract in place with each provider before it processes personal data, and we remain responsible for its work.
4. Notice of changes
- Everyone. When this list changes, we update this page and its effective date.
- Clients with a Data Processing Addendum. We email your named contact at least 30 days before a new subprocessor starts processing your personal data. You can object on reasonable data protection grounds within that period, as set out in section 8 of the Data Processing Addendum.
- Urgent replacements. If we must replace a provider urgently, for example because of an outage or a security issue, we tell affected clients as soon as we can.
- Notice list. To be told about changes by email, write to hello@worcia.com (opens in a new tab) with "Subprocessor notices" in the subject.
5. Questions
Email hello@worcia.com (opens in a new tab). Our Security page explains how we protect data and which providers process what.