Sous-traitants
Dernière mise à jour: 31 August 2026
Les prestataires tiers (sous-traitants ultérieurs) qui traitent des données à caractère personnel pour le compte de Mentiora AG lorsque vous utilisez Hollie. Nous publions cette liste afin que les clients puissent exercer leur droit d'opposition.
La version anglaise du tableau fait foi.
Sous-traitants actifs
| Prestataire | Rôle | Région | Catégories de données | Garantie de transfert |
|---|---|---|---|---|
| Cerebras Systems, Inc. | Main-turn dialogue LLM (default) | US | Full conversation content, incl. any PII the caller volunteers | SCCs + Swiss adaptations via Cerebras Inference DPA/ToS |
| Groq, Inc. (gpt-oss-120b) | Main-turn dialogue LLM (capacity router — share of turns; full-takeover overflow when primary is rate-limited) | US | Full conversation content, incl. any PII the caller volunteers | SCCs via GroqCloud DPA |
| Mistral AI SAS | Failover middle-tier LLM (armed; fires only on primary fault) | France (EU) | Full conversation content on a failover turn | EU-internal (French processor); Mistral DPA |
| Google Vertex AI — Claude Haiku 4.5 | Doctrine LLM + interview extractor + failover tail | europe-west1 | Full conversation content / owner-interview content | Google Cloud DPA (SCC module) + adequacy |
| Google Vertex AI — Gemini | Classifier (primary) + facts extraction + capture hedge + CP transcript judge | global (no ML-processing residency guarantee; at-rest EU) | Caller intent utterance; tenant public-site text; capture utterance; caller transcripts (judge) | Google Cloud DPA (SCC module) |
| ElevenLabs, Inc. | Speech-to-text (Scribe) + text-to-speech (sole TTS) | US / global endpoint | Caller audio + synthesised speech; PII read-backs | EU-US + Swiss-US DPF + SCCs via ElevenLabs DPA |
| Telnyx LLC | Telephony carrier — inbound + outbound origination + CLI presentation | US | Caller number (CLI), call audio in transit, CDR metadata | SCCs via Telnyx DPA (incorporates published DTIA) |
| LiveKit, Inc. | SIP + SFU media transport (inbound + outbound SIP leg) | UNPINNED — nearest edge, may be extra-EEA (Jerusalem/Jeddah/Dubai candidates) | Call media in transit (not recorded); SIP signalling incl. caller number | SCCs via LiveKit DPA §2.5 |
| Resend, Inc. | Transactional + lead-notification email | US | Lead contact details + enquiry message content | EU-US DPF + SCCs (Swiss adaptations) via Resend DPA |
| Stripe, Inc. | Payments / billing (subscriptions) | US | Billing contact, subscription state, masked card metadata (card data never reaches Mentiora — PCI SAQ-A) | EU-US + Swiss-US DPF + SCCs via Stripe DPA |
| Google Cloud (Google LLC) | Cloud host — compute, DB, storage | europe-west1 (CP/DB) + us-east4 (worker compute) | Hosts all of the above; app logs (IP/ts/UA, 30d), no lead PII in logs | Google Cloud DPA + adequacy / SCCs |
| Cloudflare, Inc. | CDN / reverse proxy for the landing site (proxied, in the data path) | US / global edge | Visitor IP address, TLS metadata, technical request logs | SCCs via Cloudflare DPA |
| Tavily AI, Inc. | Onboarding research web-search (agentic; funnel research pipeline, task 03) | US | Search queries + publicly-available BUSINESS web content (business-level facts: services, prices, FAQs, hours) — NOT caller/user PII; a sole-trader business name in a query, or a named owner on a public page, may be personal data (public business identity) | SCCs via Tavily DPA/ToS |
| Google LLC — Maps Platform (Geocoding API) | Address resolution: the caller-spoken ADDRESS utterance → structured components (street / postal code / city) so a booking can carry a verified address (capture-field-requirements) | US / global endpoint | ONLY the caller's spoken address slot text (contact-scrubbed — email/phone shapes stripped before egress); NEVER name, phone, appointment reason, or wider transcript | Google Cloud DPA (SCC module) + adequacy |
Votre droit d'opposition
Un client peut s'opposer à un sous-traitant dans les 3 jours ouvrables suivant notre notification de modification (nous informons l'adresse e-mail du compte enregistré à chaque modification et mettons à jour cette liste), à l'adresse [email protected]. En cas d'opposition persistante, nous proposerons si possible un sous-traitant alternatif, ou vous pourrez résilier le service concerné en vertu de la clause d'opposition de votre DPA.