Who Else Touches Your Data
Every company RuleInside and ElevenLabs use to deliver the service — what each one handles, where it’s processed, and the safeguard that covers the transfer.
Every cookie listed · Change anytime · Portal carries no tracking
Ruleinside LLC (trading as RuleInside)
Wyoming filing ID 2023-001209068 · 30 N Gould St, Ste 32376, Sheridan, WY 82801, United States of America
Contact: info (at) ruleinside.com
RuleInside uses the companies below to deliver the service. Where we act as a processor for a merchant, these are our sub-processors under Article 28 GDPR. Each is bound by a written contract imposing data protection obligations substantially equivalent to those we owe our merchants, and we remain fully liable for their performance.
How you are told about changes
We give at least 30 days' notice before adding or replacing a sub-processor. Notice is given by updating this page and writing to your registered contact address.
You may object on reasonable grounds relating to data protection within that period. If we cannot resolve the objection together, you may terminate the affected part of the service without penalty and be refunded any fees pre-paid for the terminated portion.
Engaged directly by RuleInside
| Sub-processor | What it does | What it receives | Where | Transfer safeguard |
|---|---|---|---|---|
| ElevenLabs | Runs the voice agent: speech recognition, turn-taking, speech synthesis, conversation storage | Everything spoken on a call, and the transcript | United States | EU-U.S. Data Privacy Framework, Swiss-U.S. Framework, UK Extension |
| Supabase | Database, secrets storage, file storage | The platform's stored data | Ireland | EU-hosted; no transfer arises |
| OpenAI | Generates the search embedding when a shopper asks about a product | The shopper's product query | United States | Standard Contractual Clauses |
| Stripe | Merchant billing | Merchant billing identity. No shopper data. | United States | Standard Contractual Clauses |
| Resend | Email we send to merchants | Merchant email addresses | United States | Standard Contractual Clauses |
| Better Stack | Operational monitoring and alerting | Alert data, which carries a store identifier and can carry a contact identifier | United States | Standard Contractual Clauses |
| Vercel | Hosts the merchant portal | Request metadata | United States | Standard Contractual Clauses |
| Meta Platforms (WhatsApp Business Platform) | Delivers and receives WhatsApp messages for a store that connects its own WhatsApp number to RuleInside | Shopper telephone numbers, and the content of WhatsApp messages sent and received | United States | Standard Contractual Clauses |
Engaged by ElevenLabs
These are not our direct sub-processors. They are engaged by ElevenLabs, and our obligations as to them flow through our contract with ElevenLabs rather than from any direct relationship. We name them because a merchant assessing risk needs to see the whole chain, not the first link.
| Party | What it does |
|---|---|
| Twilio | Telephone connectivity for inbound and outbound calls |
| Meta (WhatsApp) | WhatsApp message delivery for a store whose messaging runs through ElevenLabs rather than through its own connected number. Where the store connects its own number, Meta is our direct sub-processor instead - see the table above. |
| The language model that composes the agent's replies, on some agents | |
| Anthropic | The language model that composes the agent's replies, on other agents |
| OpenAI | The language model that composes the agent's replies, on some agents |
ElevenLabs maintain their own list at compliance.elevenlabs.io.
Which language model answers
The language model is selected per agent. The platform may complete a reply on a different provider's model than the one configured, when the selected model is slow to respond. The table above therefore names every provider that may handle a conversation, not only the one configured for a given agent.
Where your data is processed
Our database is in Ireland, inside the European Economic Area. The voice pipeline is processed in the United States — that is where call audio and the primary transcript are handled.
Transfers to the United States rely on the recipient's Data Privacy Framework certification or on the Standard Contractual Clauses, both permitted mechanisms under Chapter V of the GDPR.
EU-only processing of call audio is not currently available. If your organisation requires it, tell us before you sign rather than afterwards.
Questions: info (at) ruleinside.com.