In short
- Audio goes to one place: Deepgram's EU endpoint. It is not stored anywhere.
- Transcript text and account data are stored at Convex in the EU (Ireland).
- Transcript text and related context are sent to OpenAI in the United States to update discovery tracking, answer product questions and write summaries, drafts and briefs. Response storage is disabled on each request; OpenAI retains API data for up to 30 days for abuse monitoring and does not train on it.
- We give customers 30 days' notice by email before a new subprocessor starts processing their data, with the right to object.
- Services you connect yourself (Google, Microsoft, Slack) are listed separately. They act under their own terms and your permissions.
01How this list works
A subprocessor is a vendor we use to run Stuntpony that handles personal data for us. We choose each one for a specific job, sign a data processing agreement with it, and check that it does not use your data for its own purposes. Where a vendor is outside the EU we rely on the European Commission's Standard Contractual Clauses in that vendor's DPA, and on the EU-US Data Privacy Framework where the vendor is certified.
Notice of changes. Before a new subprocessor processes customer data, or an existing one takes on a new role, we email the customer's contact at least 30 days ahead and record the change in the changelog below. A customer who objects on reasonable data protection grounds can raise it with us at hi@stuntpony.com; if we cannot resolve it, the customer may end the affected service. Removals are listed without notice.
The date at the top of the page is the version of this list. Pilot customers are also covered by the notice period in their pilot terms.
02The call path
What runs while a Representative is on an assisted call, in order.
| Vendor | Applies to | Purpose | Data processed | Location | Safeguard |
|---|---|---|---|---|---|
| Deepgram, Inc. | Assisted calls | Speech-to-text | Live audio from the Representative's microphone and the call audio playing on their computer; the returned transcript text. Model-improvement opt-out on every request. Audio is not retained. | EU | No transfer: EU processing |
| Convex, Inc. | All Service data | Database, backend and file storage | Account data, transcripts, coaching output, summaries, drafts, calendar and Slack data, company knowledge, uploads. | EU (Ireland) | No transfer: EU processing |
| OpenAI OpCo, LLC | Assisted calls, post-call output, briefs, workspace chat | Language models | Client statements, discovery status and prospect context (earlier calls, notes, relevant team-channel messages) during a call; the full transcript after a call for the summary and draft follow-up, with the invitation's participant email addresses; calendar details, team-channel messages, Google Drive text and web-research results for briefs; company website text for embeddings. Response storage is disabled on each request; OpenAI retains API data for up to 30 days for abuse monitoring and does not train on it. | United States | Standard Contractual Clauses in the vendor's DPA |
03Research and company knowledge
| Vendor | Applies to | Purpose | Data processed | Location | Safeguard |
|---|---|---|---|---|---|
| Firecrawl (Mendable, Inc.) | Company knowledge | Crawl the customer's public product website | The public website address the customer provides and the pages found under it. | United States | Standard Contractual Clauses in the vendor's DPA |
| Exa AI, Inc. | Briefs | Web search | Search queries built from the prospect's company name, competitor names and the topic of a pre-call brief. | United States | Standard Contractual Clauses in the vendor's DPA |
| Tavily, Inc. | Briefs | Web search | Same as Exa. | United States | Standard Contractual Clauses in the vendor's DPA |
04Website, email and app delivery
| Vendor | Applies to | Purpose | Data processed | Location | Safeguard |
|---|---|---|---|---|---|
| Vercel, Inc. | Website and web workspace | Hosting of stuntpony.com | HTTP requests, IP address and browser user agent at the edge, sign-in cookies in transit. | Global edge, functions in the EU and US | Standard Contractual Clauses in the vendor's DPA |
| Cloudflare, Inc. | Desktop app updates | Authenticated delivery of signed app updates | A one-time download ticket and the request itself. No account data, no logging configured. | Global | Standard Contractual Clauses in the vendor's DPA |
| Resend, Inc. | Beta onboarding | Transactional email | Recipient email address and first name for the beta welcome email. No call content is ever emailed. | EU (Ireland) | No transfer: EU processing |
| PostHog, Inc. | Website, when analytics is enabled | Cookieless usage analytics | Page views and aggregate usage. No cookie, no local storage, no session recording. Do Not Track honoured. | EU (Frankfurt) | No transfer: EU processing |
05Services you connect
These are not subprocessors we choose; they are systems the Customer or the Representative connects to Stuntpony. We receive data from them only with the permission granted at connection time, and we send to them only what the feature needs.
| Service | Direction | Permission | What moves |
|---|---|---|---|
| Google (sign-in) | In | Basic profile | Name, email address, profile picture. |
| Microsoft (sign-in) | In | Basic profile | Name, email address, profile picture. |
| Google Calendar and Drive | In | Read-only calendar and Drive, requested together | Events for the next 7 days with attendees, descriptions and attached files; Drive file text when a brief cites it. |
| Microsoft 365 calendar | In | Read-only calendar | Events for the next 7 days with attendees and join links. |
| Slack | In and out | Bot in invited channels | Messages from the last 30 days in invited channels; recaps we post; replies and votes on them. |
06What we do not use
No advertising networks, no third-party tracking scripts, no crash reporting service, no CRM connection unless a customer asks for one in writing, and no AI provider other than OpenAI. If any of that changes it will appear above, with notice.
07Changelog
- 23 September 2026. Descriptions reworded at category level. No change of vendors.
- 22 September 2026. First published version of this list.
08Questions
Ask for a vendor's DPA, the safeguards for a specific transfer, or to be added to the change-notice list at hi@stuntpony.com. The privacy policy explains how each category of data is used.