Subprocessors and Data Processing

This page lists the third-party subprocessors that Joby ("we," "us," "our") engages to help deliver the Service. A "subprocessor" is a vendor that processes Customer Data on our behalf. We notify customers of material additions to this list at least 30 days before the change takes effect, where reasonable, by updating this page and emailing the primary contact on the account. If you require email notification of every subprocessor change, contact us at support@joby.io to be added to the notification list. The list below was last reviewed on the date at the top of this page.

**Supabase** Purpose: Postgres database, auth, storage, edge functions Data: All Customer Data, account credentials, files, recordings Entity location: United States Data transfers: AWS us-east-1 ────────── **Twilio** Purpose: Voice calls, SMS, programmable telephony, A2P 10DLC Data: Phone numbers, call audio (transient), SMS content, dial metadata Entity location: United States Data transfers: Global PoP routing ────────── **Stripe** Purpose: Subscription billing, prepaid credit purchases, Joby Pay merchant processing Data: Card details, billing addresses, transaction history (Joby never stores PANs) Entity location: United States Data transfers: EU and US ────────── **OpenAI** Purpose: AI agent realtime audio, AI estimates, Joby AI chat, Whisper transcription Data: Conversation transcripts, prompt content, audio (during call) Entity location: United States Data transfers: US only (zero-retention contract) ────────── **Deepgram** Purpose: Live call transcription Data: Audio streams (transient), resulting transcripts Entity location: United States Data transfers: US only ────────── **Resend** Purpose: Outbound transactional and marketing email delivery Data: Recipient email addresses, message bodies Entity location: United States Data transfers: US ────────── **Cloudflare** Purpose: Static asset CDN, DNS, Pages hosting Data: IP addresses, request logs Entity location: Global edge network Data transfers: Edge locations worldwide ────────── **Google Maps Platform** Purpose: Maps, address autocomplete, geocoding, timezone lookup, routing, service areas, live dispatch map Data: Addresses, coordinates, IP addresses, map interactions, route requests Entity location: Global Data transfers: EU and US ────────── **Transistor Software** Purpose: Mobile background geolocation SDK used by Joby's native app Data: Device location readings and diagnostics processed by the mobile SDK; resulting route points are sent to Joby systems Entity location: Canada / United States Data transfers: Canada and US ────────── **Apollo.io** Purpose: Marketing site visitor analytics (joby.io only, post-consent) Data: Page view events, IP-derived company info Entity location: United States Data transfers: US ────────── **Google (GTM, Analytics, Ads)** Purpose: Marketing site analytics + ads measurement (joby.io only, post-consent) Data: Page views, click events, ad attribution Entity location: Global Data transfers: EU and US ────────── **Meta (Facebook Pixel)** Purpose: Marketing site conversion tracking (joby.io only, post-consent) Data: Page view events, ad attribution Entity location: United States Data transfers: US ────────── **Intercom** Purpose: Customer support chat widget on app.joby.io Data: User identifier, support conversation content Entity location: United States Data transfers: US ────────── **Capgo** Purpose: Mobile app over-the-air update delivery Data: Device identifier, app version, update download events Entity location: Global edge network Data transfers: Edge locations ────────── **Railway** Purpose: OpenAI Realtime relay service for AI agent calls Data: Audio streams (transient, not stored) Entity location: United States Data transfers: US

Joby is established in the United States and processes data primarily in the United States. Where customer data is transferred from the European Economic Area, the United Kingdom, or Switzerland to the United States or other countries, we rely on: - The European Commission's Standard Contractual Clauses (SCCs) where required - The UK International Data Transfer Addendum where applicable - Subprocessor contractual commitments to apply equivalent safeguards downstream We do not currently certify under the EU-US Data Privacy Framework. Customers requiring DPF-certified processing of EU personal data should contact us before signing.

If you require a signed Data Processing Agreement to satisfy your own GDPR, UK GDPR, CCPA, or contractual obligations, review our Data Processing Addendum at /data-processing-addendum. We offer a countersigned DPA on request. To request a DPA: 1. Email legal@joby.io with your organization name, the entity name to appear on the DPA, and the role of the signatory. 2. We will send our standard DPA (PDF) for review. 3. Most DPAs are countersigned within 5 business days. We do not negotiate substantive changes for plans below Enterprise. Our standard DPA incorporates: - Article 28 GDPR processor obligations - Standard Contractual Clauses for data transfers (where applicable) - Reference to this Subprocessor list as our notification mechanism for changes - Sub-processor approval and audit rights consistent with industry norms Enterprise customers may request a redlined DPA, security questionnaire (SIG Lite or CAIQ), penetration test summary, and SOC 2 readiness statement (Joby is not currently SOC 2 certified — a readiness summary is available on request).

If you are an end user of a business that uses Joby (e.g. a customer who got a call, SMS, or invoice from a Joby user), please contact that business directly to exercise your rights — they are the controller of their customer data. For data Joby controls directly (Joby account holders, prospects, marketing site visitors), email privacy@joby.io with your request. We respond within 30 days as required by GDPR / CCPA.

Privacy and DPA: legal@joby.io General support: support@joby.io Joby CRM LLC 1180 South Beverly Drive Los Angeles, CA 90035 United States