1. How this list works
We engage the sub-processors below to host and operate the platform. Each is bound by a written data-processing agreement, receives only the data needed for its task, and is prohibited from using personal data to train AI models or for its own purposes.
Notification of changes. We will update this page and email the owner of every Customer workspace at least 30 days before adding or replacing a sub-processor. Customers may object as described in Section 6 of the DPA. To receive notifications at an additional address, email hello@dialogislabs.com.
Transfer mechanisms. "EU" means the data stays in the EU/EEA. "DPF" means the provider is certified under the EU-U.S. Data Privacy Framework (we verify certification against the official list at dataprivacyframework.gov). "SCCs" means the European Commission's Standard Contractual Clauses (2021/914) are in place.
2. Infrastructure and platform sub-processors
| Sub-processor | Purpose | Data processed | Location | Safeguard |
|---|---|---|---|---|
| Google Cloud EMEA Ltd (Google Cloud Platform), Ireland | Hosting of the platform: application servers (Cloud Run), PostgreSQL database with vector search (Cloud SQL), cache (Memorystore), file and object storage (Cloud Storage), delivery of the chat widget files and hosted Mind pages under dialogislabs.com, our self-hosted analytics (Umami), secrets, logging and monitoring; Vertex AI for text embeddings, the sensitive-topic check that can hold an answer for the Operator's review, the agent that builds hosted pages and, where configured, Gemini language models | All Customer Content and Conversation Data, account data, logs, analytics events | Frankfurt, Germany (europe-west3); Vertex AI model inference in EU regions where available, otherwise Google's global endpoints | EU; Google Cloud Data Processing Addendum incl. SCCs and DPF for any support access from outside the EEA |
| Google LLC, USA (Firebase Cloud Messaging) | Push notifications to Customers who allow them in the admin platform or a mobile app (for example "an answer is waiting for your review") | Push token of the browser or device, notification text (never an End User's message) | USA and Google's global infrastructure | Firebase Data Processing and Security Terms; SCCs; DPF |
| Google Ireland Ltd (Google Workspace), Ireland | Our business email (hello@dialogislabs.com) and documents: support, privacy requests, legal notices, signed documents such as Voice Consents | Whatever you send us by email or we exchange with you | EU | EU; Google Workspace Data Processing Addendum; SCCs and DPF for any support access from outside the EEA |
| Amazon Web Services EMEA SARL, Luxembourg | Amazon Cognito: identity provider for sign-in to the admin platform (email/password and Google sign-in), which sends the email verification codes; Amazon SES: receiving email addressed to dialogis.io; Amazon S3 and CloudFront: delivery of our websites under dialogis.io | Customer account identities and email addresses; incoming email; website visitor technical data (edge logs) | Stockholm, Sweden (eu-north-1) and Ireland (eu-west-1); CloudFront edge caches worldwide serve only public files | EU; AWS Data Processing Addendum incl. SCCs and DPF for any support access from outside the EEA |
| Cloudflare, Inc., USA | Turnstile bot check when a trial Mind is built: tells people from scripts without a CAPTCHA | IP address, browser and device signals, the challenge token | USA; Cloudflare's global network | Cloudflare Data Processing Addendum; SCCs; DPF |
| Stripe Payments Europe, Ltd., Ireland (with Stripe, Inc., USA) | Merchant of record for paid Plans (Terms, Section 4.4): checkout, subscription billing, tax determination and collection, invoices, refunds and disputes, customer billing portal | Customer billing contact, billing address, tax details, payment method (entered directly with Stripe), transaction history | Ireland; USA | Stripe acts as an independent controller for the purchase and for its own regulatory obligations under its privacy policy; Stripe Data Processing Agreement, SCCs and DPF for the data it processes for us (subscription status, customer identifier) |
3. AI model and content-processing sub-processors
| Sub-processor | Purpose | Data processed | Location | Safeguard |
|---|---|---|---|---|
| OpenAI, L.L.C., USA (contracting entity for EEA customers: OpenAI Ireland Ltd) | Large language models that generate a Mind's answers, route and refine queries, understand images in Knowledge Sources, and generate persona and behaviour prompts | End-User message, retrieved passages of Knowledge Sources, persona instructions, recent conversation history; images from Knowledge Sources | USA | OpenAI Data Processing Addendum; SCCs (we do not rely on the Data Privacy Framework for this provider) with supplementary measures: TLS in transit, data minimisation, no training, abuse-monitoring retention of at most 30 days; our transfer impact assessment is available on request; API data is not used for training |
| Google LLC, USA (Gemini API) | Reading web pages, video and audio at URLs supplied as Knowledge Sources; test conversations in the admin platform; alternative language model where configured | Content of URLs supplied by the Customer; test messages by Authorised Users | USA | Gemini API Data Processing Addendum for paid services; SCCs; DPF; data is not used for training |
| ElevenLabs, Inc., USA | Speech-to-text (transcription of voice messages, uploaded audio and video, trial voice samples and live voice input), text-to-speech, real-time voice calls (conversational agents), and Voice Clones created with the voice owner's explicit consent | Audio spoken or uploaded by End Users and Customers, transcripts, text of answers to be spoken, voice-call audio and transcripts (kept in our account under its terms until we delete them), Voice Clone recordings and voice models | USA | ElevenLabs Data Processing Agreement; EU-U.S. Data Privacy Framework (Eleven Labs, Inc. is certified) and SCCs; data is not used for training; voice-call audio and transcripts are deleted from our account after 30 days |
| Mistral AI SAS, France | Optical character recognition of scanned documents and images in Knowledge Sources | Page images of documents uploaded by the Customer | France (EU) | EU; Mistral Data Processing Agreement |
| Apify Technologies s.r.o., Czech Republic | On the Customer's instruction: crawling of websites supplied as Knowledge Sources and import of the expert's public LinkedIn posts | URLs and public content the Customer asks us to import | Czech Republic (EU) | EU; Apify Data Processing Agreement |
| Jina AI GmbH, Germany | Fetching and converting web pages supplied as Knowledge Sources into text | URLs supplied by the Customer and their public content | Germany (EU) | EU; Jina AI Data Processing Agreement |
4. Messaging channel providers
These providers transport messages between End Users and Minds when a Customer connects a Channel. The Customer connects its own account with the provider; the provider processes data under its own terms and privacy policy as an independent service and is not a sub-processor of Dialogis.
| Provider | Channel | Data exchanged | Location |
|---|---|---|---|
| Meta Platforms Ireland Ltd | WhatsApp Business Platform; Instagram Messaging API | Message content, phone number or account identifier, profile name, delivery metadata | Ireland; USA (Meta relies on the DPF and SCCs) |
| Telegram FZ-LLC / Telegram Messenger Inc. | Telegram Bot API; also used by Customers who upload Knowledge Sources through our Telegram knowledge bot, and for voice calls started from Telegram | Message content, Telegram user ID and username, voice messages; Knowledge Sources a Customer sends through the bot | United Arab Emirates and Telegram's data centres worldwide |
Telegram: the United Arab Emirates has no EU adequacy decision and Telegram does not offer Standard Contractual Clauses. Messages are exchanged with Telegram only because the End User chose Telegram to hold the conversation, which makes the transfer necessary to perform that conversation (Article 49(1)(b) GDPR); the Customer accepts this as controller when it connects the Channel (DPA Section 10.1(b)). Knowledge Sources a Customer sends through the knowledge bot are transferred on the Customer's own instruction.
5. Integrations selected by the Customer
When a Customer connects one of the following services, Dialogis sends the data the Customer configures (typically the End User's contact details, request summary and the relevant part of the conversation) to the Customer's own account with that service, on the Customer's instruction. The service acts for the Customer, not for Dialogis.
- CRM systems: HubSpot, Pipedrive, Raynet, Flowii, GramCRM, AutoCRM;
- calendar booking: Cal.com, Inc. (USA). When a Customer connects its Cal.com account, a Mind can offer meeting times and create bookings; the End User's name, email address, time zone and the chosen time are sent to the Customer's Cal.com account, which emails the confirmation. Cal.com processes this data for the Customer under the Customer's own agreement with Cal.com;
- custom webhooks to endpoints the Customer specifies;
- Google (sign-in with a Google account, at the Customer's choice).
6. Changes since the previous version
| Date | Change |
|---|---|
| 10 October 2026 | Corrections after an audit of our documents against the platform as it runs. Added, already in use: Cloudflare (Turnstile bot check on the trial builder), Google LLC Firebase Cloud Messaging (push notifications), Google Workspace (our business email) and, as a Customer-selected integration, Cal.com (calendar booking, available since 1 October 2026). These providers were in use before this list named them, so the 30-day notice in Section 6.2 of the DPA could not be given; Customers who object may do so now under that Section and we will treat the objection as timely. Corrected: OpenAI processes data in the USA (we do not currently use an EU data-residency endpoint) and retains API data for up to 30 days for abuse monitoring; Amazon SES only receives mail for us, it does not send our notices; Stripe is described as merchant of record; ElevenLabs entry now covers real-time voice calls and the retention of call audio in our account; Vertex AI entry now covers the sensitive-topic check and the hosted-page agent; Telegram entry now covers Customers' knowledge uploads. |
| 2 September 2026 | First published list. Compared with the providers named in the July 2026 privacy policy: Pinecone (vector database) and Hugging Face (embeddings) are no longer used; vector search now runs inside the EU-hosted database and embeddings are produced by Google Vertex AI in the EU. Workflow orchestration (Temporal) is self-hosted inside our Google Cloud project and is therefore not a sub-processor. |
7. Questions
Email hello@dialogislabs.com. Copies of the safeguards (SCCs, DPF certifications, provider data-processing terms) are available to Customers on request.