The following subprocessors have been vetted and are categorized across two domains: Subscriber services and Corporate subprocessors.

SUBSCRIBER SERVICE SUBPROCESSORS: Tools and services empowering subscriber services.

Subprocessors Processing Location and Activity Data Processed Circumstances under which this subprocessor may apply

Voxbone

Belgium.

Caller’s PSTN number and audio stream.

This only applies when customers dial into a meeting using PSTN using some country specific dial-in numbers. Customers can choose to use other numbers provided by other vendors.

Plivo

United States.

Plivo processing may occur in Austin, TX; Chicago, IL; New York, NY; Seattle, WA; San Francisco, VA; Los Angeles, CA.

Caller’s PSTN number and audio stream.

This only applies when customers dial into a meeting using PSTN using some country specific dial-in numbers. Customers can choose to use other numbers provided by other vendors.

Twilio

United States.

Twilio processing may occur in Ashburn, Virginia; San Jose, California; and Umatilla, Oregon.

Caller’s PSTN number and audio stream.

Standby: For SMS recipient’s PSTN number and message text

This only applies when customers dial into a meeting using PSTN using some country specific dial-in numbers. Customers can choose to use other numbers provided by other vendors.

Used by StarLeaf Standby when sending meeting invites by SMS.

Media Network Services

Norway, Germany or USA depending on jurisdictional choice.

Recorded meeting media and metadata.

Used to record meetings. This subprocessor only applies to customers who have purchased the optional enterprise conference recording services.

SendGrid

United States.

Processing may occur in Denver, CO; Irvine, CA; and Redwood City, CA.

Business email address, Meeting title, description and participants in the case where the StarLeaf portal is used to schedule meetings.

Portal-initiated meeting invites and service notifications.

This subprocessor is used for the sending of various service-related email.

Where the customer uses the portal to schedule meetings, this subprocessor is used to send invites including meeting subject, details and participants.

This does not apply where customers schedule meetings using StarLeaf scheduling add-ins.

Amazon S3

Location is tied to jurisdictional choice.

Encrypted attachments.

For files shared via StarLeaf chat, if enabled.

BlueJeans Gateway by Verizon

United States.

Teams gateway service. Processing may occur in US South in Texas; US West 2 in Washington; West Europe in Netherlands; in Victoria in Australia.

SIP URI, media streams This subprocessor only applies to customers who have purchased the optional MS Teams gateway services which are for connecting room systems to Microsoft Teams meetings.

Google

United States (California).

Processing occurs worldwide.

Chat message notifications

Standby: Names, email addresses, IP addresses of Standby administrators

Google Firebase used for sending notification to Android devices of chat messages. This only applies to users who have installed StarLeaf on an Android device and who have enabled notifications.

Google Firebase used by StarLeaf Standby for authentication of Standby administrators. Only applies to Standby customers.

Apple, Inc.

United States (California).

Processing occurs worldwide.

Chat message notifications, incoming call notifications

Used for sending message notifications to iOS devices. This only applies to users who have installed StarLeaf on an iOS device and have enabled messages.

Used for sending incoming call notifications to iOS devices. This only applies to users who have installed StarLeaf on an iOS device.

CORPORATE SUBPROCESSORS: Corporate commerce.

Subprocessors Processing Activity Processing Location Circumstances under which this subprocessor may apply

Microsoft O365

Corporate commerce

EU

For direct communications between StarLeaf staff and customers; for example, an email exchange.

Allendevaux & Company

Data protection

St. Kitts/Nevis

Provides independent Data Protection Officer (DPO) services for international data protection and complex compliance.

Google Analytics

Website analytics

United States.

Processing may occur in South Carolina; Oregon; Nevada; North Carolina; Oklahoma; Tennessee; Nebraska; Iowa; Georgia; Alabama; Virginia; Texas; Ohio; Nevada; Ireland; Denmark; Netherlands; Taiwan; Singapore; Belgium; Finland; Chile.

For monitoring and reporting on web traffic to StarLeaf websites.

Salesforce

Marketing and support activities

United Kingdom

For marketing, CRM, helpdesk and ticketing.

Zuora

Billing Management

United States.

Processing occurs in Redwood City, California.

Records of billing transactions are kept within Zuora.

Stripe

Credit card processing

United States.

Processing occurs in San Francisco, California.

This subprocessor only applies to direct customers who pay by credit card. Stripe provides PCI compliance.