LIST OF SUBPROCESSORS
Version 1.0 · 26 September 2026 · Bolutions LTD
In order to provide the Platform — AI chatbots and the inbox in which the staff of clients monitor and manage conversations — Bolutions LTD engages the service providers listed in the table. Each of them processes personal data solely in order to provide its service to us and is bound by a data processing agreement.
This page constitutes Annex III to the Personal Data Processing Agreement that we conclude with each client. We notify clients of any intended change to this list at least 30 days in advance, with the right to object.
Subprocessors
| Subprocessor | Service | Country of processing | Data processed |
|---|---|---|---|
| Google LLC (Gemini API, paid tier) | AI model: composing the bot's replies and analysing completed conversations | USA and other locations of Google's infrastructure | Content of conversations, the client's instructions and knowledge, the page the visitor is viewing. Google does not use these data to train models; it retains them for a limited time solely for the purpose of detecting misuse |
| Supabase Inc. — bot database | Database and file storage of the bot | EU (Ireland); provider: USA | Conversations and messages, files sent, visitor identifiers, conversation analysis, clients' encrypted access keys |
| Supabase Inc. — inbox database | Database, user login and storage of the inbox | EU (Germany, Frankfurt); provider: USA | Copies of conversations and media files, notifications to staff, contacts and notes, accounts of users of the Platform, audit log |
| Railway Corporation | Bot server (API) | EU; provider: USA | Data in transit, system logs, IP addresses |
| Vercel Inc. | Delivery of the chat widget and hosting of the inbox | Widget: global content delivery network; inbox: EU (Germany, Frankfurt); provider: USA | IP addresses, data in transit, system logs |
| Langfuse GmbH | Monitoring of the bot's operation: technical traces of model and tool calls | EU | Content of model calls, including conversation messages; conversation identifier. Retained for 30 days |
| Inngest Inc. | Background jobs of the inbox: receiving messages from Meta channels, notifications to staff, scheduled deletion | USA | Identifiers and metadata of jobs; for the receipt of messages, also the content of the message (text, name and contact of the sender), until the message is written to the inbox database; for notifications to staff, the name or number of the sender and the beginning of the message |
Services that the client chooses or contracts itself
These services are not our subprocessors. The client chooses them or contracts with them directly, and is responsible for their use. We connect them to the Platform only at its request.
| Service | What it is for | Data |
|---|---|---|
| Meta Platforms Ireland Ltd. — WhatsApp, Instagram, Messenger | Messaging channels that the client connects itself. On connecting, the client accepts the terms of the company Meta; we receive and send messages on its behalf, as a technical service provider | Content of messages, account identifier and profile name of the sender. Country of processing: EU / USA |
| The client's systems (its CRM, email, order software, webhook) | Forwarding enquiries and messages to the client's staff | Only the data that the client chooses to receive |
| Telegram | Notifying the client's staff in its Telegram group that a new enquiry has arrived | Name, contact and a short description of the enquiry. Telegram does not offer a data processing agreement; the client chooses it with that knowledge |
| The client's Meta Pixel | Measuring the performance of the client's ads | Moments in the conversation (opening, first message, contact details left, click on call or WhatsApp) and the placing of an order with the order amount — without the content of the conversation and without contact details |
| The client's AI account | If the client wants the bot to run on its own account with the AI model provider | The same as for Google in the table above; the data processing agreement is then concluded by the client with that provider |
Transfer of data outside the EU and the United Kingdom
The Platform's databases are located in the European Union. For providers with their registered office or processing in the USA, the transfer is based on the standard contractual clauses that form part of their data processing agreements (with the addendum for the United Kingdom) and on their certification under the EU–US Data Privacy Framework, where it exists. The USA appears on the list of countries with an adequate level of protection referred to in Article 64 of the Law on Personal Data Protection of the Republic of Serbia only under the “Privacy Shield” framework, which has not been valid since 2020, so we do not rely on that list.
What we do not use
We do not use advertising networks within the Platform, tools for tracking the behaviour of users within the inbox, or payment processing. Conversations are not used to train AI models.
Contact
Questions regarding this list: office@bolutions.agency