Sous-traitants
Dernière mise à jour: 1 October 2026
Les prestataires tiers (sous-traitants ultérieurs) qui traitent des données à caractère personnel pour le compte de Mentiora AG lorsque vous utilisez Hollie. Nous publions cette liste afin que les clients puissent exercer leur droit d'opposition.
La version anglaise du tableau fait foi.
Sous-traitants actifs
| Prestataire | Rôle | Région | Catégories de données | Garantie de transfert |
|---|---|---|---|---|
| Cerebras Systems, Inc. | AI language model (call handling) | US | Full conversation content, incl. any PII the caller volunteers | SCCs + Swiss adaptations via Cerebras Inference DPA/ToS |
| Google Vertex AI — Claude Haiku 4.5 | AI language model (call handling, owner interviews, dashboard) | United States (us-east5) + EU (europe-west1) | Full conversation content / owner-interview content | Google Cloud DPA (SCC module) + adequacy |
| Google Vertex AI — Gemini | Classifier (primary) + failover LLM tier + facts extraction + capture hedge + CP transcript judge + knowledge grouping (AI-named fact sub-groups) + knowledge-base embeddings | global (no ML-processing residency guarantee; at-rest EU) | Caller intent utterance; full conversation content on a failover turn; tenant public-site text; tenant business fact text (grouping); tenant-uploaded document text; capture utterance; caller transcripts (judge) | Google Cloud DPA (SCC module) |
| ElevenLabs, Inc. | Speech-to-text (Scribe) + text-to-speech (sole TTS) | US / global endpoint | Caller audio + synthesised speech; PII read-backs | EU-US + Swiss-US DPF + SCCs via ElevenLabs DPA |
| Telnyx LLC | Telephony carrier — inbound + outbound origination + CLI presentation | US | Caller number (CLI), call audio in transit, CDR metadata | SCCs via Telnyx DPA (incorporates published DTIA) |
| LiveKit, Inc. | SIP + SFU media transport (inbound + outbound SIP leg) | UNPINNED — nearest edge, may be extra-EEA (Jerusalem/Jeddah/Dubai candidates) | Call media in transit (not recorded); SIP signalling incl. caller number | SCCs via LiveKit DPA §2.5 |
| Resend, Inc. | Transactional + lead-notification email | US | Lead contact details + enquiry message content | EU-US DPF + SCCs (Swiss adaptations) via Resend DPA |
| Stripe, Inc. | Payments / billing (subscriptions) | US | Billing contact, subscription state, masked card metadata (card data never reaches Mentiora — PCI SAQ-A) | EU-US + Swiss-US DPF + SCCs via Stripe DPA |
| Google Cloud (Google LLC) | Cloud host — compute, DB, storage | europe-west1 (CP/DB) + us-east4 (worker compute) | Hosts all of the above; app logs (IP/ts/UA, 30d), no lead PII in logs | Google Cloud DPA + adequacy / SCCs |
| Cloudflare, Inc. | CDN / reverse proxy for the landing site (proxied, in the data path) | US / global edge | Visitor IP address, TLS metadata, technical request logs | SCCs via Cloudflare DPA |
| Tavily AI, Inc. | Onboarding research web-search (agentic; funnel research pipeline, task 03) | US | Search queries + publicly-available BUSINESS web content (business-level facts: services, prices, FAQs, hours) — NOT caller/user PII; a sole-trader business name in a query, or a named owner on a public page, may be personal data (public business identity) | SCCs via Tavily DPA/ToS |
| Google LLC — Maps Platform (Geocoding API) | Address resolution: the caller-spoken ADDRESS utterance → structured components (street / postal code / city) so a booking can carry a verified address (capture-field-requirements) | US / global endpoint | ONLY the caller's spoken address slot text (contact-scrubbed — email/phone shapes stripped before egress); NEVER name, phone, appointment reason, or wider transcript | Google Cloud DPA (SCC module) + adequacy |
Autorisés, non actifs actuellement
Divulgués à l'avance afin qu'une activation ultérieure ne redémarre pas le délai d'opposition. Ils ne traitent pas vos données aujourd'hui.
| Prestataire | Rôle | Région | Catégories de données | Garantie de transfert |
|---|---|---|---|---|
| Groq, Inc. (gpt-oss-120b) | Main-turn dialogue LLM (not currently armed) | US | Full conversation content, incl. any PII the caller volunteers | SCCs via GroqCloud DPA |
| Mistral AI SAS | Failover LLM tier (not currently armed) | France (EU) | Full conversation content on a failover turn | EU-internal (French processor); Mistral DPA |
Votre droit d'opposition
Un client peut s'opposer à un sous-traitant dans les 3 jours ouvrables suivant notre notification de modification (nous informons l'adresse e-mail du compte enregistré à chaque modification et mettons à jour cette liste), à l'adresse [email protected]. En cas d'opposition persistante, nous proposerons si possible un sous-traitant alternatif, ou vous pourrez résilier le service concerné en vertu de la clause d'opposition de votre DPA.