Service Provider List
Effective date: October 20, 2026
Last updated: October 20, 2026
Version: 1
Responsible company: DOLLAR JUDGE INC, doing business as Headii
1. About this list
This list supplements the Privacy Policy and Regional Privacy Notice for Headii's App, compatible-device software and related account, cloud, AI and support services. It does not describe an independent shopping or marketing website's providers.
A listed service is used only for its described purpose and information. It may receive a request as a primary service or a permitted retry or fallback, but does not receive every request. A model name alone does not identify the company receiving your information. Providers that only supply a model for another party to host are not automatically recipients of your data.
The list does not expand Headii's permission to process content, authorize a future feature, change a result license, or create consent. Information about the particular online action and any required choice is provided before the action sends the relevant personal information.
2. Providers used for the described service roles
| Provider and service | Purpose | Information involved | Role and important limits |
|---|---|---|---|
| Cloudflare, Inc. — Workers, D1 and R2 | Operate the backend, account and task records, temporary content and result storage, and Headii's own support/feedback system | Necessary account, device, request and task records; submitted task content and results; support messages, attachments and necessary diagnostics | Processes hosted service data for Headii under the applicable agreement. Help/Feedback is Headii's own service, not a separate third-party help-desk product. Independent Cloudflare account and network/security processing is distinguished in its privacy policy and DPA. |
| OpenAI OpCo, LLC — OpenAI API Platform; OpenAI Ireland Limited for the EEA/Swiss processing role described in its DPA | Provide requested conversational, language, summarization and visual-content processing | Relevant question or prompt text, context, transcript text, requested images or temporary frames when the visual route is used, outputs and necessary technical records | Business/API processing, not a consumer ChatGPT account. This entry does not authorize original recording audio to be sent to OpenAI where that route has not been disclosed and enabled. API content is not opted into provider model training. The DPA's regional processor role does not itself promise European-only storage or inference. See API data controls, DPA and business terms. |
| Soniox Inc. — speech recognition and speech translation APIs | Transcribe or translate the audio involved in a requested speech task | Task audio, language and task settings, relevant vocabulary/context if supplied, transcripts or translations and necessary usage metadata | Speech processing for the requested task. Soniox states that customer content is not used to train or improve its models or services. Model-development and competitive-use restrictions remain relevant to outputs; see Section 4 below and the Soniox terms. |
| Twilio Inc. — Verify SMS, Verify Email and SendGrid | Verify phone numbers or email addresses and deliver system notifications | Phone number or email address, verification/system-message content, attempts, delivery status, time and necessary communications/security records | Headii uses these routes for verification codes and system notifications only, not user feedback text, recordings, transcripts or AI conversations. Email verification combines Verify Email and SendGrid; other system email uses SendGrid directly. Twilio has processor and independent-controller roles, explained below. |
| Google — Firebase Cloud Messaging (FCM) | Route necessary App notifications | Installation identifiers, notification tokens, generic notification payloads and delivery metadata | Push payloads do not contain recordings, transcripts, translations or AI answers. Under the Firebase service-terms mapping, FCM uses the Google APIs Terms and Firebase Data Processing and Security Terms; it is not treated as having the same product agreement as App Check. See Firebase privacy information. |
| Google — Firebase App Check | Check App/device request integrity | Attestation material, integrity results and App Check tokens | App Check is distinct from analytics. Under the Firebase service-terms mapping, it is governed by the Google Cloud Platform terms and applicable Cloud DPA. A platform attestation service may process its own verification material under separate terms. See Section 3 for the attestation provider and location information for this route. |
| GoDaddy Domains Canada, Inc. / Microsoft 365 — support, privacy and legal email | Receive and handle messages sent to Headii's support, privacy and legal addresses using the Microsoft 365 email service provided through GoDaddy | Sender and recipient addresses, contact details, message text, any attachments supplied with the correspondence, and necessary delivery metadata | The purchase and management of this mailbox service are authorized by Headii and carried out on its behalf. Privacy and legal messages are forwarded to the same mailbox used for support. This entry concerns information included in those communications, not general access to unrelated App content. It is separate from Twilio/SendGrid's verification and system-notification route. See Section 3 for this route's service entities and regional safeguards. |
Phone-system geocoding and speech playback. Headii uses system geocoding on iOS and Android to obtain a city for an optional place-based result. This service processes the location supplied for the city lookup, separately from the city-and-date request that Headii's backend sends to weather providers. AI Chat playback uses system text-to-speech and a system-selected engine or voice to process the text to be read and the language/voice settings. These are Apple system services on iOS; on Android, the geocoding implementation and speech engine depend on the phone's system configuration. Speech playback is separate from the Soniox transcription and translation services above.
These system routes are not described as uniformly offline: Android's geocoding API may use the network, and speech voices can require a network connection. This does not establish that every Headii request is sent off-device or that Google is every Android phone's recipient. Use of a system service does not expand the Privacy Policy's purposes, permissions or provider-disclosure requirements. Headii does not separately engage another cloud provider for these system geocoding or AI Chat playback functions. If the phone system processes a request online, the relevant system provider or installed speech-service provider processes it under its own applicable service terms and privacy information; the actual provider and online behavior can vary with the device and selected engine. This is not a promise of on-device-only processing.
Weather services. Headii uses WeatherAPI.com and Open-Meteo to obtain weather information for a selected or geocoded city. Headii's backend supplies the city and date for these requests. Providers may also process technical connection metadata. Open-Meteo's notice identifies OpenMeteo GmbH as an independent controller for the stated purposes and provides for deletion of individual API logs after 90 days; this is not a retention limit for all account records. See also WeatherAPI.com's privacy notice.
Twilio's independent role. Under its Data Protection Addendum and Privacy Notice, Twilio may independently process communications usage information and the limited verification/system-message information for delivery, billing, compliance, fraud and abuse prevention, analytics and service development or improvement, including abuse-related model development where its terms provide. This is not a statement that Twilio is exclusively our processor. It does not authorize sending Headii User Content or AI Improvement Contributions through that route, or using such content for Twilio's own training.
Independent account and platform services. If you choose Sign in with Apple or Google sign-in, the platform handles its own account, authentication and security information, and shares the authorized identifier and any email or name it supplies with Headii. Apple also operates the App Store and Google operates Google Play for distribution. Their regional responsible entities and independent processing are identified in the Apple Privacy Policy and Google Privacy Policy. These are not described as Headii-controlled accounts. Distribution does not mean a Paid Time Pack is currently offered or that Headii receives payment-card details.
Support access. Headii personnel may access the minimum necessary information for requested support or a specific security, abuse or legal incident, subject to the Privacy Policy's access and purpose limits. Permission to view one case does not permit general content review or model training.
Reserved support outsourcing — not currently enabled. If ordinary human customer-support or technical-support contractors are enabled, they must act only on Headii's instructions and within those same limits. Headii must identify them internally and establish applicable processing, confidentiality and international-transfer safeguards before access. Where applicable law permits, we describe them publicly by specific service category and relevant processing/access countries rather than naming each contractor; specific identities are provided when required, including in response to applicable individual-rights requests. The advance-notice requirements in Section 5 still apply.
3. Processing countries and regional safeguards
Headii is a United States company. A provider's corporate address, a billing country, an App storefront, a user's country and a selected storage location are different facts. A storage setting does not necessarily restrict computation, communications delivery, support access, logs or recovery copies to that same place.
For configured Cloudflare, OpenAI and Soniox services, regional routing uses the IP address at account registration. The current service scope does not use OpenAI's European regional endpoint; this does not change the U.S./EU Cloudflare and Soniox configurations described below. If a service fails, we do not switch these routes to the other region. This rule does not cover other providers or establish the location of all system data processing, support access or recovery processing.
The route information below distinguishes a selected content location from a provider's broader processing footprint. References to a provider's published transfer provisions apply only within the governing agreement and the scope of the relevant protection; they do not claim that Headii uses every advertised location or that every provider is certified under a data privacy framework. A European standard contractual clause or framework reference is not a blanket conclusion that every country's transfer requirements are satisfied. You can request further information about applicable contractual safeguards at privacy@headii.com.
| Service route | Processing / storage / material access locations | Regional safeguards |
|---|---|---|
| Cloudflare Workers / D1 / R2 | Headii has created production D1 databases and R2 buckets with U.S. (us) and EU (eu) jurisdiction settings for U.S. and EU user data. These settings concern the respective resource, not all Workers execution or support access. Location hints alone are not a residency guarantee. Cloudflare's default Workers placement is near the incoming request, across Cloudflare's global network. Published Developer Platform locations include the U.S., EEA, UK, Canada, Japan, Australia, India and Singapore; the service subprocessor list distinguishes infrastructure and support. See D1 and R2. | Cloudflare's standard online terms incorporate its DPA for covered personal data. Customer DPA Section 6 provides relevant EU SCC modules and the UK Addendum; its framework provisions apply to covered transfers. |
| OpenAI API Platform | Headii's current service scope does not use OpenAI's European regional endpoint. A selected endpoint alone does not guarantee that all processing occurs in one region. Under the published DPA, the regional processor for EEA/Swiss personal data is OpenAI Ireland Limited; this legal role does not identify the physical processing country. System data and some processing may be outside a selected content region. Its subprocessor list includes U.S., Irish, UK and Japanese affiliates, and Philippine support/moderation, subject to the listed purposes. | The published DPA forms part of OpenAI's Services Agreement. DPA Sections 4.1–4.2 provide for SCCs or adequacy decisions for EEA/Swiss onward transfers, and SCCs with the UK Addendum for UK data. |
| Soniox | Headii has U.S. and EU speech-service configurations, and EU regional access is enabled for its account. Soniox distinguishes region-bound project content from operational/account metadata that may be processed elsewhere; see data residency. | The terms accepted for Headii's account govern this service. The privacy policy describes international processing and possible safeguards. |
| Twilio Verify / SendGrid | Twilio documents US1 as its default processing region; SendGrid distinguishes global and EU regional sending. Headii's email route has no configured regional separation; EU regional sending and data residency have not been enabled or verified. Email content and recipient information are not guaranteed to be processed only in the recipient's region. Delivery also involves destination communications networks. An EU sending endpoint does not establish that all associated data stays in the EU. The subprocessor list identifies SendGrid infrastructure in North America and the EU; these are provider-wide locations, not Headii-specific routing. Regional availability is product-specific; a region supported for another Twilio product does not establish the processing region of Verify SMS. | The published DPA forms part of Twilio's service agreement. Twilio DPA, Schedule 3, specifies transfer mechanisms by scope and precedence, including covered framework transfers, BCRs and SCC/UK provisions. The defined BCR services exclude SendGrid. Processor and independent-controller uses remain distinct. |
| Firebase FCM | Firebase identifies FCM as a global service, not a U.S.-only or selected-database-region service. Processing can occur at Google or agent facilities; a particular Firebase project's general location does not establish FCM residency. | The Firebase Data Processing and Security Terms accepted for Headii's account provide the applicable transfer-solution/SCC framework in Section 10. FCM's processing agreement is separate from App Check's. |
| Firebase App Check and actual attestation services | Firebase also identifies App Check as global. Headii uses Google Play Integrity for App Check attestation on Android. On iOS, this route uses Apple system services. This list does not promise that App Check or platform attestation is confined to the U.S. or EU. | The Cloud DPA applicable under Headii's accepted App Check terms addresses locations and European transfers in Section 10 and Appendix 3, subject to relevant declarations. Attestation providers' own roles and terms are separate. Android Play Integrity also has its own API terms in addition to the Google APIs Terms of Service. Apple's Developer Program License Agreement contains separate platform-service conditions; its publication does not establish which iOS attestation service Headii uses or its account-specific terms. |
| GoDaddy Domains Canada, Inc. / Microsoft 365 — incoming support/privacy/legal mailbox service | Privacy and legal messages are forwarded to the same support mailbox. The recorded mailbox-storage location is Canada (September 24, 2026), with no known change since that record. This is not a guarantee that all processing, access or recovery copies are in Canada. Microsoft's Exchange Online commitments concern specified mailbox content at rest, not all service processing. Microsoft separately publishes countries from which its personnel may have controlled remote access. This service-wide scope is not a record of access to this mailbox. | GoDaddy Domains Canada, Inc. is the GoDaddy contracting entity for this mailbox service under Section 4 of the GoDaddy Microsoft 365 terms. The GoDaddy DPA covers processing within its scope. It takes effect with the service agreement; Section 9 and Schedule 4 distinguish adequacy, applicable Data Privacy Framework transfers, and SCC/UK mechanisms. The GoDaddy Microsoft 365 terms also incorporate the Microsoft Customer Agreement. Microsoft's applicable product processing terms are addressed in its commercial DPA; this route is not described as governed solely by GoDaddy's DPA. |
4. Retention, training and output-use limits
The Privacy Policy's retention rules govern Headii's copies. Providers may hold separate processing, security, delivery or recovery copies; a task disappearing from the App does not prove simultaneous erasure of all those copies. The following explains the relevant supplier behavior without extending ordinary Headii task use:
- Cloudflare: Headii's original transcription audio ends ordinary task use after seven days from receipt; transcripts do so within 90 days of generation. R2 lifecycle removal is asynchronous. Cloudflare describes removal as typically within 24 hours of expiration, not a guaranteed maximum. D1 records, recovery copies and support attachments have their own applicable limits. A database jurisdiction is not a promise that all Workers processing takes place there.
- OpenAI: default abuse-monitoring logs may contain content and ordinarily last up to 30 days, with documented legal or necessary harm-prevention exceptions. Application-state retention depends on the actual endpoint and enabled features; some objects require deletion and some caching has a separate lifetime. Headii does not describe every API use as zero-retention. Specific abuse/legal review is not routine human quality review. Any actual route must remain within the Privacy Policy's purpose and retention limits.
- Soniox: its published rules distinguish transient processing from stored asynchronous tasks. Stored Async audio and transcripts are deletable and automatically expire after 30 days under the published service rules; operational metadata is distinct from content. This supplier-copy period is not the seven-day rule for Headii's original-audio copy. We do not use restricted Soniox material for model training or evaluation; your result rights and restrictions are stated in Terms of Use Sections 7 and 11, not silently changed by this page.
- Twilio: code validity is not communications-record retention. Verify identifies 30-day limits for specified PII fields, not all data. SendGrid recovery copies can remain for up to one year after the provider agreement ends. Independent-controller records follow Twilio's applicable retention criteria. These periods do not authorize Headii to retain User Content or send it through this route.
- Firebase: installation identifiers used by FCM are retained until deletion is requested; Firebase describes removal from live and backup systems within 180 days after that call. App Check does not retain attestation material, but the actual attestation provider's rules apply to its copy. Tokens expire within their configured lifetime, at most seven days; tokens used for replay protection may be stored for up to 30 days. These are not retention periods for recordings or AI content.
Provider documentation describes the provider's service, not proof of Headii's actual configuration. The actual use remains subject to Headii's commitments: ordinary User Content is not used for model training or routine human quality review, and a supplier change does not create a new purpose or permit longer ordinary task use. Any Headii optional contribution program is separate, default-off and unavailable unless its specific conditions are satisfied.
5. Changes to providers
Headii can use different eligible processors for the same disclosed purpose, information and protection boundary without permanently tying a feature to one model. Routine routing within the listed pool need not change the main Terms of Use or Privacy Policy. Before a new recipient receives covered information, we update this list and any required regional or contextual information, subject only to the limited ordinary-support approach below.
Only for the ordinary support contractors described in Section 2, where applicable law permits category disclosure, a change of contractor does not by itself require a new public name entry. The disclosed service category, purpose, information and processing/access countries must remain accurate. Any required specific-recipient notice or choice must precede access. This limited approach does not apply to AI, speech or visual-content providers: new recipients for those services are identified by name in this list before they receive covered information. The Privacy Policy's requirements for feature-to-provider data transfers remain unchanged.
A new purpose, material data expansion, independent supplier use, training, routine human review or materially different retention or international protection is not a list-only change. The required notice, choice and any agreement update must happen first. A choice limited by law, a platform rule or its actual wording to a named recipient or fixed set is respected. This page never silently reduces rights in a result or completed purchase.
For privacy questions or a request concerning information held for Headii, contact privacy@headii.com. An independent platform's request process does not remove Headii's duties for its own copy.