How to read this list
Buk Capital LLC uses the services below to operate Inbound Booking. A provider processes information only when the relevant feature or operational activity involves it. The label subprocessor applies when we use a provider to process a business customer's personal information on that customer's behalf. Some providers also act independently for certain activities, including payment compliance, fraud prevention, account administration, or operating a user-connected service.
This page identifies the principal services used by the current application. It is not a statement that every provider has the same contractual role, retains information for the same period, or processes it only in one country. Providers may use their own infrastructure suppliers and subprocessors. Their published lists and the applicable agreements provide further details. Contact us for requirements relating to a particular business deployment or a data processing agreement.
Vercel — website and server hosting
Hosts the website and runs server-side account, integration, booking, messaging, and billing code. Relevant requests may involve account identifiers, business configuration, caller or appointment information, integration responses, and operational or security logs. Hosting is not a promise of storage or execution in only one jurisdiction.
Railway — persistent call-control hosting
Hosts the persistent process that controls enabled AI call sessions and coordinates supported actions with the application. Processing includes relevant business configuration, caller identifiers and conversation context, text transcripts, action requests and results, call identifiers, and operational metadata. Call audio travels directly between Telnyx and xAI; this Railway process does not relay the audio.
Supabase — authentication and database
Provides account authentication and the application's database. This includes business workspaces, memberships, configuration, callers, call transcripts and summaries, appointments, messages, consent information, operational events, and subscription or usage references. The application stores calendar authorization credentials in encrypted form, with the encryption key maintained outside the database.
Telnyx — telephony and text message delivery
Routes telephone calls to the AI receptionist and sends supported text messages when messaging is enabled. Processing can include telephone numbers, call audio in transit, routing and call records, message bodies, consent-related inbound keywords, delivery status, and diagnostic information. Carriers and telecommunications networks also participate in delivery. Our current application does not store audio recording files; provider processing and retention are separate matters.
xAI — AI voice processing
Processes audio and conversation context for the AI receptionist, produces speech and transcript events, and requests supported actions such as checking availability or booking an appointment. Information can include the caller's statements, configured business details, offered time slots, and tool results. We use the API voice service; an individual consumer's Grok account settings are not an Inbound Booking privacy control.
We do not represent that a zero-data-retention option or a particular regional-processing guarantee is enabled for this voice service. The applicable API terms, service capabilities, and provider configuration govern provider-side processing. Google-derived information remains subject to the Limited Use restrictions in our Privacy Policy.
Resend — account emails, call summaries, and appointment confirmations
Delivers signup, confirmation, and password recovery emails through the authentication email configuration. This involves recipient addresses, email content and links needed for the requested authentication action, and delivery or error information. When the owner enables summary emails, Resend also receives the verified recipient address, call summary and confirmed appointment details. It delivers alternate-recipient verification codes and caller-requested appointment confirmation, rescheduling, and cancellation emails as well. These integrations do not grant permission to send callers unrelated promotional messages.
Google — optional sign-in and calendar connection
When you choose Google sign-in, Google authenticates your identity and provides basic account and profile information through Supabase. Calendar access is separate and is not required for account creation or sign-in.
An owner may connect a Google account and select a writable calendar. The integration reads account and calendar metadata, checks busy time intervals, creates requested appointment events, and reconciles its event writes. Google receives the appointment information sent to that selected calendar. The business controls its calendar sharing settings. Google is also the provider of the connected account and calendar service, so its role is not identical to that of our hosting provider.
Microsoft, Apple, and Yahoo — optional connected calendars
These providers operate calendar accounts that a business owner chooses to connect. The integration accesses account and calendar metadata and event data to calculate availability, and sends caller-requested appointment details to the selected calendar. Microsoft uses delegated OAuth; Apple iCloud and Yahoo use provider-generated app passwords. The account owner controls calendar sharing and can disconnect or revoke access. A connected calendar provider's role differs from that of our hosting service.
Stripe — billing and payments
Provides hosted checkout and the billing portal when billing is enabled. We send account contact information and business identifiers for customer and subscription management, and verified usage quantities for metered billing. Stripe collects payment information through its own interface. The application retains customer, subscription, checkout, status, and usage references. We do not request payment card numbers or security codes through our own forms or receptionist. Do not provide them during a call; enter payment details only through Stripe's hosted interface.
Provider changes and questions
We may change providers as the service develops and will update this page to reflect material changes. Any separate agreement that requires advance subprocessor notice or an objection process governs that process for the relevant customer. Provider certifications, processing locations, and settings depend on the specific service and agreement. Contact hello@inboundbooking.com about a provider, processing requirement, or privacy request.