Last updated: October 13, 2026
Version: 1.1
This page lists the third-party sub-processors that Moon Sherpa Labs ("Company," "we," "us," "our") engages to process personal data in providing Follow Up Ace (also styled "Ace AI"), the "Service." It is referenced by, and forms part of, the Data Processing Agreement (Annex C) and the Privacy Policy. All listed sub-processors are based in the United States.
| Sub-processor | Purpose | Data processed | Location | DPA in place |
|---|---|---|---|---|
| Google Cloud Platform / Firebase (Google LLC) | Cloud infrastructure, database, authentication, and data-warehouse / analytics to power Ace Trove analytics, scoring, and predictions | All Service data, including CRM and analytics data | USA | Yes |
| OpenAI (OpenAI, L.L.C.) | AI chat, voice transcription/synthesis, analysis | Chat messages, relevant CRM context, voice audio | USA | Yes (API DPA; CCPA service provider; under our agreement, data excluded from training) |
| Anthropic (Anthropic, PBC) | AI chat (Claude models) | Chat messages, relevant CRM context | USA | Yes (API DPA; CCPA service provider; under our agreement, data excluded from training) |
| Google — Paid Gemini API / Vertex AI (Google LLC) | AI chat (Gemini models) — data-processor terms; excludes training | Chat messages, relevant CRM context | USA | Yes (API DPA; CCPA service provider; under our agreement, data excluded from training) |
| Stripe (Stripe, Inc.) | Payment processing | Billing data, name, email, transaction history | USA | Yes |
| ElevenLabs (ElevenLabs Inc.) | Voice AI — real-time voice activity detection, speech-to-text, and text-to-speech for the in-app AI voice assistant (streamed in real time; not deliberately recorded or stored) | Voice audio (transient, real-time processing only) | USA | Yes (API DPA; CCPA service provider; under our agreement, data excluded from training) |
| TypeSafe (TypeSafe, Inc.) | Typed classification (no text generation) — note categorization, inbound reply intent, automated-draft review, compliance scan, capture junk hold | The specific CRM note, inbound reply body or draft each decision needs | USA | API terms; written data-processing terms being documented — not used for text generation. Added to this list October 13, 2026 (in use since September 18, 2026). |
| Twilio (Twilio Inc.) | SMS notifications (appointment follow-up texts, workflow/admin alerts) | Phone numbers, SMS metadata | USA | Yes |
| Follow Up Boss (Enchant LLC) | CRM integration (bi-directional sync) | CRM data | USA | Customer's CRM provider; governed by Customer's agreement with Follow Up Boss |
| Google Gmail API (Google LLC) | OAuth-scoped email features | Email content and metadata within authorized scopes | USA | Yes (Google API Services User Data Policy / Limited Use) |
| Zillow (Zillow Group, Inc.) | Lead data integration | Lead contact information and inquiry details | USA | Per Zillow terms |
We will provide at least thirty (30) days' advance notice before adding or replacing a sub-processor that processes personal data. Notice is given by email to account administrators and/or by updating this page. Customers with a Data Processing Agreement in place may object on reasonable data-protection grounds within the notice window; if an objection cannot be resolved, the Customer's exclusive remedy is to terminate the affected Service.
Questions about this list: [email protected].