Sub-Processors | Safina AI
Last updated: 2026-10-13
As of: October 2026
This list names the service providers (sub-processors) that we engage for the Safina AI service. It supplements our privacy policy and Section VII of our data processing agreement (DPA).
AWS, Supabase, Twilio, and LiveKit Cloud take part in every call. Which AI providers process a conversation depends on the language model, the speech recognition, and the voice configured for your assistant.
Bases for Transfers to Third Countries
- No transfer: The service provider processes the data in the EU or the EEA.
- DPF: Adequacy decision of the European Commission for companies in the USA that are certified under the EU-US Data Privacy Framework (Art. 45 GDPR). You can find the certified companies at dataprivacyframework.gov.
- UK adequacy decision: Art. 45 GDPR.
- SCC: Standard Contractual Clauses of the European Commission (Art. 46(2)(c) GDPR).
- BCR: Binding Corporate Rules (Art. 47 GDPR).
If a DPF-certified provider has also agreed to Standard Contractual Clauses, these apply if the adequacy decision ceases to apply.
Hosting, Operations, and Website
| Provider | Purpose | Place of processing | Basis |
|---|---|---|---|
| DK Tech Solutions UG (haftungsbeschränkt), Schwanthalerstr. 141, 80339 Munich, Germany | Provision of the technical infrastructure until the service provider accounts move to SK Thinking Ltd; processing of payments until billing is switched over, no later than January 31, 2027 | Germany | No transfer |
| Amazon Web Services EMEA SARL, Luxembourg (Amazon Web Services, Inc., USA) | Hosting of the database, files such as audio recordings, and servers; sending of system emails (Amazon SES) | Frankfurt am Main, Germany | DPF, SCC |
| Supabase, Inc., USA | Operation of the database (including account, contact, billing and call data, with transcripts and summaries) | Frankfurt am Main, Germany (Amazon Web Services servers) | SCC |
| Hetzner Online GmbH, Gunzenhausen, Germany | Our own servers for monitoring and error analysis, including logs of AI conversations with transcripts; support chatbot; support automation | Nuremberg, Germany | No transfer |
| Cloudflare, Inc., USA | Delivery of this website; forwarding and protection of the support chatbot | Global network, processing in the nearest data center | DPF, SCC |
Telephony
| Provider | Purpose | Place of processing | Basis |
|---|---|---|---|
| Twilio Ireland Limited, Dublin, Ireland (Twilio Inc., USA) | Phone numbers, calls, forwarding, and SMS; review of documents required to provide phone numbers | Calls and SMS: Ireland for phone numbers outside the USA and Canada, USA for phone numbers from the USA and Canada. Account, billing, and phone number data including documents: USA | DPF, BCR, SCC |
| LiveKit Incorporated, USA | Call setup (SIP) and transmission of speech in calls and in the in-app assistant | Global network, processing in the nearest region; logs in the USA | DPF, SCC |
AI Features
| Provider | Purpose | Place of processing | Basis |
|---|---|---|---|
| OpenAI Ireland Ltd, Dublin, Ireland (OpenAI OpCo, LLC, USA) | Conducting conversations, speech recognition, speech generation, summaries, and analyses; analysis of websites; analysis of support requests and chat histories | USA | SCC |
| Google Cloud EMEA Limited, Dublin, Ireland (Google LLC, USA) | Conducting conversations with Gemini, in-app assistant, speech recognition, speech generation | Vertex AI and speech generation: EU (Belgium); speech recognition: Frankfurt am Main, Germany; Gemini API (e.g., in-app assistant): no fixed region, including the USA | DPF, SCC |
| AssemblyAI, Inc., USA | Speech recognition | USA or Ireland, depending on the nearest region | DPF, SCC |
| Cartesia AI, Inc., USA | Speech recognition, speech generation | USA | SCC |
| Mistral AI SAS, Paris, France | Answers of the support chatbot | EU | No transfer |
Payments
| Provider | Purpose | Place of processing | Basis |
|---|---|---|---|
| Stripe Payments Europe, Limited, Dublin, Ireland (Stripe, LLC, USA) | Payments via the website; payouts in the affiliate program (Stripe Connect) | Ireland, USA | DPF, SCC |
| RevenueCat, Inc., USA | Management of subscriptions from in-app purchases at Apple and Google | USA | SCC |
Email and Notifications
| Provider | Purpose | Place of processing | Basis |
|---|---|---|---|
| Brevo GmbH, Berlin, Germany (Sendinblue SAS, France) | Emails to users, newsletters, contact management | EU (France, Germany, Belgium) | No transfer |
| 650 Industries, Inc. (Expo), USA | Sending of push notifications | USA | DPF, SCC |
| Apple Distribution International Ltd, Cork, Ireland (Apple Inc., USA) | Delivery of push notifications to iOS devices (Apple Push Notification service) | USA | Art. 49(1)(b) GDPR (delivery to your device) |
| Google Ireland Limited, Dublin, Ireland (Google LLC, USA) | Delivery of push notifications to Android devices (Firebase Cloud Messaging) | Worldwide, including the USA | DPF, SCC |
Analytics
| Provider | Purpose | Place of processing | Basis |
|---|---|---|---|
| PostHog, Inc., USA | Analysis of website and app usage, error analysis | Frankfurt am Main, Germany | DPF, SCC |
Support and Internal Notifications
| Provider | Purpose | Place of processing | Basis |
|---|---|---|---|
| Microsoft Ireland Operations Limited, Dublin, Ireland (Microsoft Corporation, USA) | Support mailbox (Microsoft 365) | EU | DPF, SCC |
| GitHub, Inc., USA | Storage of support tickets in a non-public area | USA | DPF, SCC |
| Slack Technologies Limited, Dublin, Ireland (Slack Technologies, LLC, USA) | Internal error messages | USA | DPF, SCC |
Changes and Objection
We update this list before we engage a new sub-processor or change a sub-processor. We also inform business customers with a DPA by email.
As a business customer, you can object to the engagement or change of a sub-processor for an important reason under data protection law. Send your objection in text form to info@safina.ai within 14 days after receiving the information (Section VII of the DPA).
Authoritative Version
This document is a translation provided for informational purposes only. In case of any discrepancy between this translation and the German original, the German version shall prevail.