Subprocessors

Hosting, databases and object storage, including CRM documents, where included in the deployment. The earlier policy lists Israel and EU Paris; the project inventory must distinguish actual storage, processing, backup and support locations. A planned migration is not a completed deployment.

Other services mentioned in the Privacy Policy include activated Aircall connections, Meta/WhatsApp messages and service notifications, payment and support services. They must be included in the project inventory when their actual role and flows require it. The DPA governs advance information about relevant subprocessor changes and the Customer’s objection rights.

Application hosting and managed services where used for the relevant processing. This supplier is not removed merely because another hosting model is planned. The applicable processing description identifies the contracted entity, service and locations.

Infrastructure services listed in the earlier DPA. Their applicable scope, contractual entity and locations must be established in the project’s supplier inventory; the historical listing alone does not establish use for every Customer.

Authentication and session services where used. Authentication, Google account connections and Google Analytics are separate processing purposes and must not be treated as one authorization. The relevant service and contracting entity determine the supplier entry.

A model such as Whisper is software, not a legal entity receiving data. If MyBot contracts an external OpenAI or other inference/transcription service, the relevant entity, content sent, purpose, location and safeguards must be identified. An independent assistant chosen by the user has a different role.

Telephony and SIP services where included in the project. Identify whether the account is contracted by MyBot or the Customer and the actual data flows; the provider’s brand alone does not determine its data protection role.

Telephony, numbers or other contracted communications services within the agreed project. Voice, messaging and mobile services can have different scopes and data flows; they are not automatically all activated.

Compute or inference infrastructure where contracted, including an authorized fallback if it can receive personal data. A fallback is part of the relevant processing inventory even when it is not the normal route. No region or activation is inferred solely from this listing.