Auftragsverarbeiter
Zuletzt aktualisiert: 1 October 2026
Die Drittdienstleister (Unterauftragsverarbeiter), die im Auftrag der Mentiora AG personenbezogene Daten verarbeiten, wenn Sie Hollie nutzen. Wir veröffentlichen diese Liste, damit Mandanten ihr Widerspruchsrecht ausüben können.
Die englische Tabelle ist massgebend.
Aktive Unterauftragsverarbeiter
| Anbieter | Rolle | Region | Datenkategorien | Übermittlungsgarantie |
|---|---|---|---|---|
| Cerebras Systems, Inc. | AI language model (call handling) | US | Full conversation content, incl. any PII the caller volunteers | SCCs + Swiss adaptations via Cerebras Inference DPA/ToS |
| Google Vertex AI — Claude Haiku 4.5 | AI language model (call handling, owner interviews, dashboard) | United States (us-east5) + EU (europe-west1) | Full conversation content / owner-interview content | Google Cloud DPA (SCC module) + adequacy |
| Google Vertex AI — Gemini | Classifier (primary) + failover LLM tier + facts extraction + capture hedge + CP transcript judge + knowledge grouping (AI-named fact sub-groups) + knowledge-base embeddings | global (no ML-processing residency guarantee; at-rest EU) | Caller intent utterance; full conversation content on a failover turn; tenant public-site text; tenant business fact text (grouping); tenant-uploaded document text; capture utterance; caller transcripts (judge) | Google Cloud DPA (SCC module) |
| ElevenLabs, Inc. | Speech-to-text (Scribe) + text-to-speech (sole TTS) | US / global endpoint | Caller audio + synthesised speech; PII read-backs | EU-US + Swiss-US DPF + SCCs via ElevenLabs DPA |
| Telnyx LLC | Telephony carrier — inbound + outbound origination + CLI presentation | US | Caller number (CLI), call audio in transit, CDR metadata | SCCs via Telnyx DPA (incorporates published DTIA) |
| LiveKit, Inc. | SIP + SFU media transport (inbound + outbound SIP leg) | UNPINNED — nearest edge, may be extra-EEA (Jerusalem/Jeddah/Dubai candidates) | Call media in transit (not recorded); SIP signalling incl. caller number | SCCs via LiveKit DPA §2.5 |
| Resend, Inc. | Transactional + lead-notification email | US | Lead contact details + enquiry message content | EU-US DPF + SCCs (Swiss adaptations) via Resend DPA |
| Stripe, Inc. | Payments / billing (subscriptions) | US | Billing contact, subscription state, masked card metadata (card data never reaches Mentiora — PCI SAQ-A) | EU-US + Swiss-US DPF + SCCs via Stripe DPA |
| Google Cloud (Google LLC) | Cloud host — compute, DB, storage | europe-west1 (CP/DB) + us-east4 (worker compute) | Hosts all of the above; app logs (IP/ts/UA, 30d), no lead PII in logs | Google Cloud DPA + adequacy / SCCs |
| Cloudflare, Inc. | CDN / reverse proxy for the landing site (proxied, in the data path) | US / global edge | Visitor IP address, TLS metadata, technical request logs | SCCs via Cloudflare DPA |
| Tavily AI, Inc. | Onboarding research web-search (agentic; funnel research pipeline, task 03) | US | Search queries + publicly-available BUSINESS web content (business-level facts: services, prices, FAQs, hours) — NOT caller/user PII; a sole-trader business name in a query, or a named owner on a public page, may be personal data (public business identity) | SCCs via Tavily DPA/ToS |
| Google LLC — Maps Platform (Geocoding API) | Address resolution: the caller-spoken ADDRESS utterance → structured components (street / postal code / city) so a booking can carry a verified address (capture-field-requirements) | US / global endpoint | ONLY the caller's spoken address slot text (contact-scrubbed — email/phone shapes stripped before egress); NEVER name, phone, appointment reason, or wider transcript | Google Cloud DPA (SCC module) + adequacy |
Autorisiert, derzeit nicht aktiv
Vorab offengelegt, damit eine spätere Aktivierung die Widerspruchsfrist nicht neu auslöst. Diese verarbeiten Ihre Daten heute nicht.
| Anbieter | Rolle | Region | Datenkategorien | Übermittlungsgarantie |
|---|---|---|---|---|
| Groq, Inc. (gpt-oss-120b) | Main-turn dialogue LLM (not currently armed) | US | Full conversation content, incl. any PII the caller volunteers | SCCs via GroqCloud DPA |
| Mistral AI SAS | Failover LLM tier (not currently armed) | France (EU) | Full conversation content on a failover turn | EU-internal (French processor); Mistral DPA |
Ihr Widerspruchsrecht
Mandanten können innerhalb von 3 Werktagen nach unserer Änderungsmitteilung (wir informieren die registrierte Konto-E-Mail-Adresse bei jeder Änderung und aktualisieren diese Liste) einem Unterauftragsverarbeiter widersprechen, unter [email protected]. Bei einem anhaltenden Widerspruch schlagen wir, soweit möglich, einen alternativen Unterauftragsverarbeiter vor, oder Sie können den betroffenen Dienst gemäss der Widerspruchsklausel Ihres AVV kündigen.