العودة إلى الرئيسية
وثيقة قانونية
سجل المعالِجين الفرعيين
الأطراف الخارجية التي تستعين بها handlo.ai لمعالجة البيانات الشخصية، ويُحدَّث وفقًا للمادتين 28 و30 من اللائحة العامة لحماية البيانات.
آخر تحديث: 2 نوفمبر 2026|ساري من: 2 نوفمبر 2026
تُنشر هذه الوثائق القانونية بشكل رسمي باللغة الإنجليزية. النسخ المترجمة قادمة قريبًا — في غضون ذلك يُعتبر النص الإنجليزي أدناه ملزمًا.
يسرد الجدول التالي المعالِجين الفرعيين الذين تستعين بهم handlo.ai لمعالجة البيانات الشخصية نيابةً عن عملائها، بما في ذلك الغرض وفئات البيانات وموقع الاستضافة وآلية النقل القانونية.
| المعالِج الفرعي | الغرض | فئات البيانات | موقع الاستضافة | آلية النقل |
|---|---|---|---|---|
| Supabase, Inc. | Primary database and file storage | Contact identifiers, Call data, AI-generated data, Account data | European Union and/or United States (currently United States: Oregon, AWS us-west-2) | Standard Contractual Clauses (Module 3) for hosting in the United States |
| Vercel Inc. | Web application and API hosting, serverless compute (including the knowledge lookups and tool requests the AI agent makes during calls), private storage of per-agent knowledge index snapshots (Vercel Blob), content delivery, and bot detection (BotID) | Account data, Contact identifiers, Call data, Transcript, Knowledge-base content, IP address, Device / browser signals | European Union and/or United States (currently United States: the web application, API compute, in-call knowledge lookups and tool requests, and knowledge index snapshot storage in Portland, Oregon); global edge network | Standard Contractual Clauses (Module 3) |
| Vapi.ai | AI voice call processing and the managed speech pipeline | Caller phone number, Call recording, Transcript | United States | Standard Contractual Clauses (Module 3) |
| Google LLC | Gemini language model that generates the AI agent’s replies during calls and speech-recognition fallback (engaged via Vapi); Calendar integration and Google Drive document ingestion (when enabled) | Transcript, Call audio, Assistant configuration, Knowledge-base content, Calendar event data, Document content, Account data | United States | Standard Contractual Clauses (Module 3) |
| Anthropic, PBC | Claude language model that generates the AI agent’s replies during calls (engaged via Vapi) | Transcript, Assistant configuration, Knowledge-base content | United States | Standard Contractual Clauses (Module 3); engaged via Vapi |
| OpenAI, L.L.C. | Embeddings, summarization, website reading for knowledge and demos, abuse screening, and AI content generation | Transcript, Knowledge-base content, AI-generated data | United States | Standard Contractual Clauses (Module 3) |
| Soniox, Inc. | Speech-to-text transcription of calls (engaged via Vapi) | Call audio, Transcript, Business names and terms from the knowledge base | United States | Standard Contractual Clauses (Module 3); engaged via Vapi |
| ElevenLabs, Inc. | Text-to-speech voice synthesis (engaged via Vapi) | Assistant speech content | United States | Standard Contractual Clauses (Module 3); engaged via Vapi |
| Cartesia AI | Text-to-speech voice synthesis (engaged via Vapi) | Assistant speech content | United States | Standard Contractual Clauses (Module 3); engaged via Vapi |
| Microsoft Azure | Text-to-speech / speech-to-text for select languages (engaged via Vapi); embeddings of callers' knowledge questions (Azure OpenAI, engaged directly) | Assistant speech content, Call audio, Transcript | United States (embeddings: US West; speech: region managed by Vapi) | Standard Contractual Clauses (Module 3) |
| CNTXT – FZCO (Munsit) | Arabic-dialect text-to-speech voice synthesis (Arabic voices only) | Assistant speech content | United Arab Emirates | Standard Contractual Clauses (Module 3) |
| Twilio Inc. | Phone infrastructure, WhatsApp message transport (BSP), and phone-number reputation (Lookup) | Caller phone number, Notification content | United States | Standard Contractual Clauses (Module 3) |
| Telnyx LLC | Phone infrastructure | Caller phone number | United States | Standard Contractual Clauses (Module 3) |
| Meta Platforms, Inc. | WhatsApp platform / notification delivery | Caller phone number, Notification content | United States | Standard Contractual Clauses (Module 3) |
| Telegram Messenger Inc. | Telegram notification delivery to the Customer's own Telegram chat (only when the Customer enables it) | Notification content | Outside the EEA | At the Customer's instruction — the Customer selects Telegram as its own notification channel |
| Stripe, Inc. | Payment processing (Stripe acts as an independent controller for payment data) | Billing contact, Payment metadata | United States | Standard Contractual Clauses (Module 3); Stripe's own controller-level safeguards apply |
| Resend, Inc. | Transactional email delivery | Recipient email, Notification content | United States | Standard Contractual Clauses (Module 3) |
| Functional Software, Inc. (Sentry) | Error monitoring and diagnostics (processes only Handlo diagnostic data) | IP address, Diagnostic metadata | United States | Standard Contractual Clauses (Module 3) |
| Cloudflare, Inc. | Bot verification on public forms and calls (Turnstile), DNS, private storage of call recordings (R2), and private temporary intake of call recordings (R2) from the voice provider | IP address, Device / browser signals, Call recording | Global network (Turnstile, DNS); call-recording storage in the European Union and/or United States (currently United States: Western North America location hint; recordings stored before this storage was introduced remain with Supabase in the European Union until moved); temporary recording intake in the European Union and/or United States (currently a Western Europe location hint). Location hints are best-effort placement, not a jurisdiction guarantee | Standard Contractual Clauses (Module 3) for hosting in the United States |
| Upstash, Inc. | Rate limiting and short-lived caching | Caller phone number, Cached assistant configuration, Transient call-session data, Aggregated analytics | European Union and/or United States (currently United States: Oregon, us-west-2) | Standard Contractual Clauses (Module 3) for hosting in the United States |
| Amazon Web Services, Inc. | Background worker / job-processing compute and job queue (exports, recordings, transcripts) | Contact identifiers, Call data, AI-generated data, Account data | European Union and/or United States (currently European Union: Frankfurt, eu-central-1) | Standard Contractual Clauses (Module 3) for hosting in the United States; currently EU-hosted, with no transfer outside the EEA |
| PostHog, Inc. | Product analytics (consent-gated; ingest reverse-proxied via /ingest) | Usage / event data, IP address, Pseudonymous user identifier | European Union and/or United States (currently European Union: PostHog EU Cloud) | Standard Contractual Clauses (Module 3) for hosting in the United States; currently EU-hosted, with no transfer outside the EEA |
| Crisp IM SAS | Support live-chat widget | Contact identifiers, Support message content, IP address | European Union (France) | EU hosting — no transfer outside the EEA |
| IPQualityScore, Inc. (IPQS) | Caller phone-number reputation / spam scoring (Growth and Business tiers) | Caller phone number | United States | Standard Contractual Clauses (Module 3) |
| Microsoft Corporation | OneDrive & SharePoint document ingestion and Outlook calendar booking (when enabled) | Document content, Account data, Appointment data | United States / European Union | Standard Contractual Clauses (Module 3) |
| HighLevel, Inc. (GoHighLevel) | CRM sync to the Customer's connected GoHighLevel account (when enabled) | Contact identifiers, Lead / opportunity data, Call summary | United States | At the Customer's instruction — sent only to the Customer's own connected account, under the Customer's agreement with that provider |
| HubSpot, Inc. | CRM sync to the Customer's connected HubSpot account (when enabled) | Contact identifiers, Lead / deal data, Call summary | United States | At the Customer's instruction — sent only to the Customer's own connected account, under the Customer's agreement with that provider |
| Block, Inc. (Square) | Appointment booking and customer lookup in the Customer's connected Square account (when enabled) | Contact identifiers, Appointment data | United States | At the Customer's instruction — sent only to the Customer's own connected account, under the Customer's agreement with that provider |
| Octopusapp Inc. (Jobber) | Customer lookup and request intake in the Customer's connected Jobber account (when enabled) | Contact identifiers, Request / job data | Canada / United States | At the Customer's instruction — sent only to the Customer's own connected account, under the Customer's agreement with that provider |
| Themis Solutions Inc. (Clio) | Enquiry intake to the Customer's connected Clio Grow account (when enabled) | Contact identifiers, Enquiry details | Canada / United States / European Union (per the Customer's Clio region) | At the Customer's instruction — sent only to the Customer's own connected account, under the Customer's agreement with that provider |
| Zoho Corporation | CRM and booking sync to the Customer's connected Zoho CRM or Zoho Bookings account (when enabled) | Contact identifiers, Lead / appointment data | Per the Customer's Zoho data centre (e.g. United States, European Union, India) | At the Customer's instruction — sent only to the Customer's own connected account, under the Customer's agreement with that provider |
سنُخطر العملاء قبل 30 يومًا على الأقل من إضافة أي معالِج فرعي أو استبداله، وفقًا لما هو منصوص عليه في ملحق معالجة البيانات لدينا.