List of subprocessors
Last updated
The companies Dehurdle uses to process personal data, what each one does and where it processes the data.
Overview
Dehurdle (THRIVING BILLIONS PRIVATE LIMITED) uses the companies below to run its service. For organization customers (Team, Scale and Enterprise) they are subprocessors under our Data Processing Addendum, and each one is bound by data processing terms. For individual accounts, Dehurdle is the controller and these companies process data on our behalf as described in our privacy policy.
Where data is processed
Hosting
Dehurdle runs on Amazon Web Services in Mumbai, India: application servers, the database, the cache and email. Personal data from the EU and the UK is transferred to India, and to the USA for live voice conversations, under the EU Standard Contractual Clauses and the UK Addendum, as set out in section 10 of our DPA.
AI processing
Dehurdle's own AI features use Google Cloud (Vertex AI and Speech-to-Text) and no other AI provider. Live voice runs in the USA, scoring and the coach in India, and speech-to-text on Google's global endpoint. Practice audio isn't stored after the session ends, except that an organization can allow practice calls longer than 10 minutes, for which Google keeps a call's live state, including its audio, for up to 24 hours; transcripts, scores and feedback are stored by Dehurdle on AWS in India. Our DPA commits that Dehurdle doesn't use customer personal data to train or fine-tune AI models, and Google Cloud's terms for Vertex AI don't allow Google to use it to train its models.
AI assistants users connect
Users can connect Dehurdle to ChatGPT (OpenAI) or Claude (Anthropic) to find, build and open practices and to read their own scorecards. OpenAI and Anthropic aren't Dehurdle subprocessors: the user, from their own assistant account, asks Dehurdle to send them the data, and they process it under that account's terms. In an organization workspace, this is off until the organization's owner turns it on. What is sent is described in section 5 of our privacy policy.
CRM accounts companies connect
A company can connect its own HubSpot account or Zoho CRM organization so its reps can build practices from deals and see their scores there. Neither is a Dehurdle subprocessor: each is the company's own system, connected on the company's instruction. What Dehurdle reads and writes is described in section 3 of our privacy policy.
Subprocessors
| Name | Purpose | Location | Data categories | Data processing terms |
|---|---|---|---|---|
| Amazon Web Services | Hosting: application servers, database, cache, backups and email (Amazon SES) | India (Mumbai, ap-south-1) | All personal data Dehurdle stores: account details, phone numbers, transcripts, scores, feedback, speaking and camera metrics, coach chats, usage and log data. Email addresses and the content of emails we send. | AWS Data Processing Addendum |
| Google Cloud (Vertex AI, Speech-to-Text) | Live AI practice conversations (Gemini Live), speech-to-text, scoring and feedback, the AI coach and understanding WhatsApp messages | USA, us-central1, with Google's US multi-region when it is busy (live voice); India, asia-south1 (scoring, coach, WhatsApp); global endpoint (speech-to-text) | Practice audio streamed during live conversations, the AI persona's speech and voice input to the coach for transcription, transcripts and session details for scoring, coach messages, WhatsApp messages and voice notes, and the documents and descriptions used to build custom scenarios. If the customer allows practice calls longer than 10 minutes, Google keeps a call's live state, including its audio, for up to 24 hours to carry the call on | Google Cloud Data Processing Addendum |
| Meta Platforms (WhatsApp Cloud API) | WhatsApp practice and calls, reminders, scorecard summaries and sign-in codes. Only if WhatsApp is used. | Global, including the USA | Phone number, messages sent to and from the user (such as sign-in codes, reminders, first name, scenario titles, scores and feedback), voice notes, and call audio streamed during WhatsApp calls | WhatsApp Business Data Processing Terms |
| WorkOS | Sign-in and single sign-on, including when a user connects an AI assistant such as ChatGPT or Claude | USA | Name, email address, password or single sign-on identity and organization membership; if the organization connects its directory, the user records it syncs; when a user connects an AI assistant, their Dehurdle user ID, name and email address | WorkOS Data Processing Addendum |
| Razorpay | Payments | India | Organization and plan details, the payer's name and email address (prefilled at checkout), order and payment identifiers and amounts. Card details go directly to Razorpay and never reach Dehurdle. | Razorpay Terms of Use and Privacy Policy |
| Slack | Reminders, scorecard summaries and the Dehurdle bot in direct messages. Only if the organization connects Slack. | USA | Work email address (used to find the user's Slack account), Slack user ID and workspace, and direct messages between the user and the Dehurdle bot (such as reminders, scenario titles, scores and coaching replies) | Slack Data Processing Addendum |
Changes to this list
Before a new subprocessor starts processing customer personal data, we give at least 30 days' notice by email to the admins of each organization customer and by updating this page. An organization customer can object during that period on reasonable data protection grounds. If we can't resolve the objection, the customer can end the affected services, as set out in section 5 of our DPA.
Questions about subprocessors: reach@dehurdle.com.