Data processing
Sub-processors
In short
- These are the outside services that handle personal information for Macy: Google Cloud, Telnyx and Cloudflare, and Meta when a business connects WhatsApp.
- The information is stored and processed in the United States.
- A change to this list is made here before it starts, and business customers are told by email, as the Data Processing Addendum describes.
The services Macy runs on
Each of these handles information for us, on our instructions, under its own data processing terms. For the people who contact a business they are sub-processors: the business is the controller, we are its processor, and these work for us.
| Service | What it does for Macy | What it handles | Where | Its terms |
|---|---|---|---|---|
| Google Cloud: hosting | Runs the service’s server (Cloud Run), its database (Firestore), the storage for call recordings (Cloud Storage), the store for keys (Secret Manager) and the server’s log (Cloud Logging). | Everything the service stores: accounts and settings, calls and their transcripts, recordings, messages, meetings, contact cards and WhatsApp conversations. The log holds ids, codes and the last four digits of phone numbers. | United States. The server and the recordings: region us-east4 (Northern Virginia). The database: the United States multi-region nam5. | Cloud Data Processing Addendum |
| Google Cloud: Vertex AI, with Google’s Gemini models | The voice model that listens and speaks on a call and writes its transcript. The text model that answers on WhatsApp and in the owner’s chat, reads a business’s website, writes a contact card’s summary and prepares a brief before a meeting. For a brief, and before a call the owner asks for, the model can search the web with Google Search. | The sound of a call as it happens, in both directions, and what the business taught Macy. The text of conversations, with long runs of digits masked when a call is read for a summary. A search for a brief carries a company’s name or the domain of an email address, and a person’s name only when it clearly identifies them. | United States: Google’s multi-region endpoint for the United States. | Cloud Data Processing Addendum |
| Google Cloud: Speech-to-Text | Turns a voice note sent on WhatsApp into text. | The sound of the voice note. The service keeps the text, not the sound. | United States. | Cloud Data Processing Addendum |
| Google Cloud: Identity Platform | Keeps and checks the password of a business owner who signs in with an email and a password, and sends the emails that confirm an address or reset a password. | A business owner’s email address, name and password. | Google Cloud. We do not choose a region for it. | Cloud Data Processing Addendum |
| Google: the Gemini API | Not used today. The software can use it as a second route to the same text model when Vertex AI turns a request down, but only with a key for it, and none is configured. | The text of that one request: a WhatsApp conversation, an owner’s chat with Macy, a website being read or a brief before a meeting. Never the voice on a call, and never the reading of a call for a contact card’s summary. | Not tied to one region. | Gemini API Additional Terms of Service |
| Telnyx | The telephony provider: Macy’s phone numbers, and the path a call takes between the telephone network and the service. It does not record or transcribe for us. | The phone numbers on a call, its time and length, the keys pressed during it, and the sound of the call while it passes through. | United States. | Telnyx Data Processing Addendum |
| Cloudflare | Serves this site. Stands in front of the app and passes its traffic on to the service. Forwards mail sent to hello@meetmacy.com to our team. | Of a visitor to the site: the IP address, the browser and the pages asked for. Of a business owner in the app: everything that travels between the browser and the service, passing through. Of someone who emails us: the message, passing through. Our own code on Cloudflare stores none of it. Calls, and the events that the telephony provider and WhatsApp send, do not pass through Cloudflare. | Cloudflare’s network, which has servers in many countries. | Cloudflare Data Processing Addendum |
| Meta: the WhatsApp Business Platform | Only when a business connects its WhatsApp Business number: carries the messages between that business’s customers and Macy. | The messages, the WhatsApp numbers and profile names of the people who write, their voice notes, and the ids of the business’s WhatsApp account. | Meta’s own systems. | Meta Terms for WhatsApp Business Platform and the WhatsApp Business Data Processing Terms |
Services a business connects itself
Google Calendar and Google Meet. When a business connects its own Google Calendar, Macy reads when the owner is busy and puts meetings on that calendar, with a meeting link, and Google sends the invite to the guest. Google then receives the meeting’s title, time and description and the guest’s name and email address, in the business’s own Google account and under the business’s own agreement with Google. What Macy does with the calendar’s data is in the Privacy Policy.
What our own team uses
- Email. A message sent to hello@meetmacy.com is forwarded to our team’s own mailboxes and answered from there.
- AI tools for development and operations, such as Anthropic’s Claude, which help us build the service and find faults, and may see information while we look into one.
Built in and switched off
The software can send the text of a conversation, with phone numbers and email addresses removed and no sound, to a second AI model at TypeSafe (api.typesafe.ai), which reviews how the conversation went. This is switched off, and nothing is sent to it today. It will be listed above, with its terms, before it is switched on.
Changes to this list
Before a service is added to this list or replaced, and before one of them starts keeping information somewhere else, this page changes and business customers are told at their account’s email address, so that they can object, as the Data Processing Addendum describes. Every version of this page carries its number and the date it comes into force at the top.
Questions, or a copy of a provider’s terms: hello@meetmacy.com.
In force from October 19, 2026. Version 1.1. See also the Data Processing Addendum, the Privacy Policy, the Terms of Use and the Accessibility Statement.