Who handles data for us
Updated 30 October 2026. These companies process personal data for Voxum. Each is bound by a data processing agreement, except Telegram, which offers none for bots; someone who texts a room on Telegram does so under Telegram's own terms. A provider marked off gets nothing until the feature that needs it is switched on. We update this page before anyone new starts, and hosts who signed in hear 30 days before. Write to privacy@heartdok.dev to object.
| Company | What it does for Voxum | What it gets | Where | Status |
|---|---|---|---|---|
| Cloudflare, Inc. | Runs Voxum: serves pages, runs rooms, stores presentations, files and answers, relays live voice, writes a recap's takeaways and hears a host's recorded talk with models it runs, keeps logs | Everything Voxum holds | Its global network. Cloudflare places stored data, most of it in the United States, and a live room's storage near where the room started | On |
| WorkOS, Inc. | Signs hosts in | A host's email address and sign-in methods, and their name and profile picture when they sign in with Google | United States | On |
| Twilio Inc. | Carries text messages and WhatsApp messages to and from rooms | A texter's number and messages | United States | Off until texts are switched on |
| Telnyx LLC | Carries text messages to and from rooms | A texter's number and messages | United States | Off until texts are switched on |
| Meta Platforms, Inc. | Carries WhatsApp messages to and from rooms | A texter's WhatsApp number and messages | United States and the EU | Off until WhatsApp is switched on |
| Telegram Messenger Inc. | Carries Telegram messages to and from rooms | A texter's Telegram chat id and messages | Its data centers worldwide | Off until Telegram is switched on |
Data from the EU, the UK and Switzerland reaches the United States under the European Commission's Standard Contractual Clauses and the UK's addendum to them.
Not on this list:
- The meeting app a host uses (Teams, Zoom, Webex or Google Meet). When a room opens inside one, that app is its own service under its own terms with the host.
- A host's own AI agent. It works for the host, with the host's library key, under the host's terms with its maker.
- Google, when a host signs in with their Google account. Google tells our sign-in provider who they are, under the host's own account with Google.
- Google, when a host brings in a Google Slides link. We fetch the presentation the host pointed us to and send Google nothing about anyone.
- Google Drive, OneDrive and Dropbox, when a host opens a presentation from one or saves a session's answers to one. The host's browser talks to the service directly, under the host's own account with it, and our servers get only the file the host opened.