Technology providers
Sub-processors · Last updated: 2026-08-03
1. Web infrastructure and email
| Provider | Purpose | Data | Location | Safeguards |
|---|---|---|---|---|
| Cloudflare, Inc. DPA |
CDN, DNS, security proxy, Workers, Pages, Access (SSO) and the D1 database behind our CRM | IP addresses, HTTP headers, aggregated visit data and CRM lead and client records | US Critical | SCCs + EU-US DPF |
| Hostinger International Ltd. DPA |
Hosting of the agentiko.es website | Static site files, access logs | EU | Intra-EU processing |
| Google LLC (Workspace) DPA |
Professional email @agentiko.es |
Inbound and outbound email, contacts | US | SCCs + EU-US DPF (certified) |
| Vercel Inc. DPA |
Hosting of demos and conversational agents | Execution logs, session data | US | SCCs |
2. AI models
| Provider | Purpose | Data | Location | Safeguards |
|---|---|---|---|---|
| Anthropic, PBC DPA |
Claude model for our conversational agents and development | User messages + conversation context | US Critical | SCCs + DPA. Training opt-out by default on the API. |
| OpenAI, L.L.C. DPA |
Additional models through our brokapi gateway | User messages + context | US | SCCs + DPA. No training on API data. |
| Google LLC (Gemini API) Terms |
Additional AI models when the agent requires them | User messages + context | US | SCCs + DPA. No-training on the paid tier. |
| ElevenLabs Inc. DPA |
Speech synthesis through brokapi | Text converted into audio | US | SCCs + DPA |
| NVIDIA Corporation Privacy |
Hosted models reachable through brokapi | User messages + context | US | SCCs |
3. Voice telephony agents
These four providers power the “Manuel” voice agent. We declare them before switching them on: as of today they handle no real calls.
| Provider | Purpose | Data | Location | Safeguards |
|---|---|---|---|---|
| Retell AI DPA |
Voice call orchestration | Voice, transcript, name, phone number | US Coming | SCCs + DPA |
| Deepgram, Inc. DPA |
Speech-to-text transcription | Call audio | US Coming | SCCs + DPA |
| Cartesia AI Privacy |
Synthesis of the reply voice | Agent reply text | US Coming | SCCs |
| Twilio Inc. DPA |
Telephony: call reception and routing | Phone number, call metadata and audio | US Coming | SCCs + EU-US DPF |
4. Databases and operations
| Provider | Purpose | Data | Location | Safeguards |
|---|---|---|---|---|
| Supabase Inc. DPA |
Postgres database for AI agents and events | Names, conversation messages, session identifiers | EU Critical | Intra-EU processing (Frankfurt) + DPA |
| Brevo SAS DPA |
Lead pipeline and transactional email | Email, name, pipeline stage | EU | Intra-EU processing (France) |
5. Web analytics
Google Analytics and Microsoft Clarity are only enabled if you consent in the cookie notice. Cloudflare Web Analytics and Umami use no cookies.
| Provider | Purpose | Data | Location | Safeguards |
|---|---|---|---|---|
| Google LLC (Analytics 4) Terms |
Behavioural analytics, consent only | _ga cookies, anonymised IP, page views |
US | SCCs + EU-US DPF. Consent Mode v2. |
| Microsoft Corporation (Clarity) DPA |
Session recording and heatmaps, consent only | _clck/_clsk cookies, mouse movement, clicks, scrolling |
US | SCCs + EU-US DPF |
| Umami Software, Inc. Privacy |
Aggregated cookieless analytics | Page visited, country, browser. IP not stored. | US | SCCs |
6. Change notification
Whenever we add, replace or remove a sub-processor, we update this page and state the date in the header. If you have an active contract with us and a change materially affects you, we will notify you by email at least 15 days in advance so you have time to object.
7. Questions
If you would like the full text of any DPA, a copy of the applicable Standard Contractual Clauses, or have any question about how we process your data with these providers, write to [email protected].