Responsabili del trattamento (sub-processor)
Ultimo aggiornamento: 31 August 2026
I fornitori terzi (sub-responsabili) che trattano dati personali per conto di Mentiora AG quando utilizzi Hollie. Pubblichiamo questo elenco affinché i clienti possano esercitare il diritto di opposizione.
Fa fede la tabella in lingua inglese.
Sub-responsabili attivi
| Fornitore | Ruolo | Regione | Categorie di dati | Garanzia di trasferimento |
|---|---|---|---|---|
| Cerebras Systems, Inc. | Main-turn dialogue LLM (default) | US | Full conversation content, incl. any PII the caller volunteers | SCCs + Swiss adaptations via Cerebras Inference DPA/ToS |
| Groq, Inc. (gpt-oss-120b) | Main-turn dialogue LLM (capacity router — share of turns; full-takeover overflow when primary is rate-limited) | US | Full conversation content, incl. any PII the caller volunteers | SCCs via GroqCloud DPA |
| Mistral AI SAS | Failover middle-tier LLM (armed; fires only on primary fault) | France (EU) | Full conversation content on a failover turn | EU-internal (French processor); Mistral DPA |
| Google Vertex AI — Claude Haiku 4.5 | Doctrine LLM + interview extractor + failover tail | europe-west1 | Full conversation content / owner-interview content | Google Cloud DPA (SCC module) + adequacy |
| Google Vertex AI — Gemini | Classifier (primary) + facts extraction + capture hedge + CP transcript judge | global (no ML-processing residency guarantee; at-rest EU) | Caller intent utterance; tenant public-site text; capture utterance; caller transcripts (judge) | Google Cloud DPA (SCC module) |
| ElevenLabs, Inc. | Speech-to-text (Scribe) + text-to-speech (sole TTS) | US / global endpoint | Caller audio + synthesised speech; PII read-backs | EU-US + Swiss-US DPF + SCCs via ElevenLabs DPA |
| Telnyx LLC | Telephony carrier — inbound + outbound origination + CLI presentation | US | Caller number (CLI), call audio in transit, CDR metadata | SCCs via Telnyx DPA (incorporates published DTIA) |
| LiveKit, Inc. | SIP + SFU media transport (inbound + outbound SIP leg) | UNPINNED — nearest edge, may be extra-EEA (Jerusalem/Jeddah/Dubai candidates) | Call media in transit (not recorded); SIP signalling incl. caller number | SCCs via LiveKit DPA §2.5 |
| Resend, Inc. | Transactional + lead-notification email | US | Lead contact details + enquiry message content | EU-US DPF + SCCs (Swiss adaptations) via Resend DPA |
| Stripe, Inc. | Payments / billing (subscriptions) | US | Billing contact, subscription state, masked card metadata (card data never reaches Mentiora — PCI SAQ-A) | EU-US + Swiss-US DPF + SCCs via Stripe DPA |
| Google Cloud (Google LLC) | Cloud host — compute, DB, storage | europe-west1 (CP/DB) + us-east4 (worker compute) | Hosts all of the above; app logs (IP/ts/UA, 30d), no lead PII in logs | Google Cloud DPA + adequacy / SCCs |
| Cloudflare, Inc. | CDN / reverse proxy for the landing site (proxied, in the data path) | US / global edge | Visitor IP address, TLS metadata, technical request logs | SCCs via Cloudflare DPA |
| Tavily AI, Inc. | Onboarding research web-search (agentic; funnel research pipeline, task 03) | US | Search queries + publicly-available BUSINESS web content (business-level facts: services, prices, FAQs, hours) — NOT caller/user PII; a sole-trader business name in a query, or a named owner on a public page, may be personal data (public business identity) | SCCs via Tavily DPA/ToS |
| Google LLC — Maps Platform (Geocoding API) | Address resolution: the caller-spoken ADDRESS utterance → structured components (street / postal code / city) so a booking can carry a verified address (capture-field-requirements) | US / global endpoint | ONLY the caller's spoken address slot text (contact-scrubbed — email/phone shapes stripped before egress); NEVER name, phone, appointment reason, or wider transcript | Google Cloud DPA (SCC module) + adequacy |
Il tuo diritto di opposizione
Un cliente può opporsi a un sub-responsabile entro 3 giorni lavorativi dalla nostra notifica di modifica (informiamo l'indirizzo e-mail dell'account registrato a ogni modifica e aggiorniamo questo elenco), scrivendo a [email protected]. In caso di opposizione persistente proporremo, ove possibile, un sub-responsabile alternativo, oppure potrai risolvere il servizio interessato ai sensi della clausola di opposizione del tuo DPA.