Responsabili del trattamento (sub-processor)
Ultimo aggiornamento: 1 October 2026
I fornitori terzi (sub-responsabili) che trattano dati personali per conto di Mentiora AG quando utilizzi Hollie. Pubblichiamo questo elenco affinché i clienti possano esercitare il diritto di opposizione.
Fa fede la tabella in lingua inglese.
Sub-responsabili attivi
| Fornitore | Ruolo | Regione | Categorie di dati | Garanzia di trasferimento |
|---|---|---|---|---|
| Cerebras Systems, Inc. | AI language model (call handling) | US | Full conversation content, incl. any PII the caller volunteers | SCCs + Swiss adaptations via Cerebras Inference DPA/ToS |
| Google Vertex AI — Claude Haiku 4.5 | AI language model (call handling, owner interviews, dashboard) | United States (us-east5) + EU (europe-west1) | Full conversation content / owner-interview content | Google Cloud DPA (SCC module) + adequacy |
| Google Vertex AI — Gemini | Classifier (primary) + failover LLM tier + facts extraction + capture hedge + CP transcript judge + knowledge grouping (AI-named fact sub-groups) + knowledge-base embeddings | global (no ML-processing residency guarantee; at-rest EU) | Caller intent utterance; full conversation content on a failover turn; tenant public-site text; tenant business fact text (grouping); tenant-uploaded document text; capture utterance; caller transcripts (judge) | Google Cloud DPA (SCC module) |
| ElevenLabs, Inc. | Speech-to-text (Scribe) + text-to-speech (sole TTS) | US / global endpoint | Caller audio + synthesised speech; PII read-backs | EU-US + Swiss-US DPF + SCCs via ElevenLabs DPA |
| Telnyx LLC | Telephony carrier — inbound + outbound origination + CLI presentation | US | Caller number (CLI), call audio in transit, CDR metadata | SCCs via Telnyx DPA (incorporates published DTIA) |
| LiveKit, Inc. | SIP + SFU media transport (inbound + outbound SIP leg) | UNPINNED — nearest edge, may be extra-EEA (Jerusalem/Jeddah/Dubai candidates) | Call media in transit (not recorded); SIP signalling incl. caller number | SCCs via LiveKit DPA §2.5 |
| Resend, Inc. | Transactional + lead-notification email | US | Lead contact details + enquiry message content | EU-US DPF + SCCs (Swiss adaptations) via Resend DPA |
| Stripe, Inc. | Payments / billing (subscriptions) | US | Billing contact, subscription state, masked card metadata (card data never reaches Mentiora — PCI SAQ-A) | EU-US + Swiss-US DPF + SCCs via Stripe DPA |
| Google Cloud (Google LLC) | Cloud host — compute, DB, storage | europe-west1 (CP/DB) + us-east4 (worker compute) | Hosts all of the above; app logs (IP/ts/UA, 30d), no lead PII in logs | Google Cloud DPA + adequacy / SCCs |
| Cloudflare, Inc. | CDN / reverse proxy for the landing site (proxied, in the data path) | US / global edge | Visitor IP address, TLS metadata, technical request logs | SCCs via Cloudflare DPA |
| Tavily AI, Inc. | Onboarding research web-search (agentic; funnel research pipeline, task 03) | US | Search queries + publicly-available BUSINESS web content (business-level facts: services, prices, FAQs, hours) — NOT caller/user PII; a sole-trader business name in a query, or a named owner on a public page, may be personal data (public business identity) | SCCs via Tavily DPA/ToS |
| Google LLC — Maps Platform (Geocoding API) | Address resolution: the caller-spoken ADDRESS utterance → structured components (street / postal code / city) so a booking can carry a verified address (capture-field-requirements) | US / global endpoint | ONLY the caller's spoken address slot text (contact-scrubbed — email/phone shapes stripped before egress); NEVER name, phone, appointment reason, or wider transcript | Google Cloud DPA (SCC module) + adequacy |
Autorizzati, attualmente non attivi
Comunicati in anticipo affinché una successiva attivazione non faccia ripartire il termine di opposizione. Oggi non trattano i tuoi dati.
| Fornitore | Ruolo | Regione | Categorie di dati | Garanzia di trasferimento |
|---|---|---|---|---|
| Groq, Inc. (gpt-oss-120b) | Main-turn dialogue LLM (not currently armed) | US | Full conversation content, incl. any PII the caller volunteers | SCCs via GroqCloud DPA |
| Mistral AI SAS | Failover LLM tier (not currently armed) | France (EU) | Full conversation content on a failover turn | EU-internal (French processor); Mistral DPA |
Il tuo diritto di opposizione
Un cliente può opporsi a un sub-responsabile entro 3 giorni lavorativi dalla nostra notifica di modifica (informiamo l'indirizzo e-mail dell'account registrato a ogni modifica e aggiorniamo questo elenco), scrivendo a [email protected]. In caso di opposizione persistente proporremo, ove possibile, un sub-responsabile alternativo, oppure potrai risolvere il servizio interessato ai sensi della clausola di opposizione del tuo DPA.