Torna alla home
Documento legale
Registro dei sub-responsabili
I terzi a cui handlo.ai affida il trattamento dei dati personali, aggiornato ai sensi degli articoli 28 e 30 del GDPR.
Ultimo aggiornamento: 14 giugno 2026|In vigore: 14 giugno 2026
Questi documenti legali sono pubblicati ufficialmente in inglese. Le versioni tradotte saranno presto disponibili — nel frattempo il testo inglese qui sotto è vincolante.
La tabella seguente elenca i sub-responsabili a cui handlo.ai affida il trattamento dei dati personali per conto dei propri clienti, comprese la finalità, le categorie di dati, il luogo di hosting e il meccanismo di trasferimento legittimo.
| Sub-responsabile | Finalità | Categorie di dati | Luogo di hosting | Meccanismo di trasferimento |
|---|---|---|---|---|
| Supabase, Inc. | Primary database and file storage | Contact identifiers, Call data, AI-generated data, Account data | European Union (Frankfurt / AWS eu-central-1) | EU hosting — no transfer outside the EEA |
| Vapi.ai | AI voice call processing and the managed speech pipeline | Caller phone number, Call recording, Transcript | United States | Standard Contractual Clauses (Module 3) |
| OpenAI, L.L.C. | Embeddings, summarization, and AI content generation | Transcript, Knowledge-base content, AI-generated data | United States | Standard Contractual Clauses (Module 3) |
| Twilio Inc. | Phone infrastructure, WhatsApp message transport (BSP), and phone-number reputation (Lookup) | Caller phone number, Notification content | United States | Standard Contractual Clauses (Module 3) |
| Telnyx LLC | Phone infrastructure | Caller phone number | United States | Standard Contractual Clauses (Module 3) |
| Deepgram, Inc. | Speech-to-text transcription (engaged via Vapi) | Call audio, Transcript | United States | Standard Contractual Clauses (Module 3); engaged via Vapi |
| ElevenLabs, Inc. | Text-to-speech voice synthesis (engaged via Vapi) | Assistant speech content | United States | Standard Contractual Clauses (Module 3); engaged via Vapi |
| Cartesia AI | Text-to-speech voice synthesis (engaged via Vapi) | Assistant speech content | United States | Standard Contractual Clauses (Module 3); engaged via Vapi |
| Microsoft Azure | Text-to-speech / speech-to-text for select languages (engaged via Vapi) | Assistant speech content, Call audio | United States / European Union (region managed by Vapi) | Standard Contractual Clauses (Module 3); engaged via Vapi |
| Meta Platforms, Inc. | WhatsApp platform / notification delivery | Caller phone number, Notification content | United States | Standard Contractual Clauses (Module 3) |
| Telegram Messenger Inc. | Telegram notification delivery to the Customer's own Telegram chat (only when the Customer enables it) | Notification content | Outside the EEA | At the Customer's instruction — the Customer selects Telegram as its own notification channel |
| Stripe, Inc. | Payment processing (Stripe acts as an independent controller for payment data) | Billing contact, Payment metadata | United States | Standard Contractual Clauses (Module 3); Stripe's own controller-level safeguards apply |
| Resend, Inc. | Transactional email delivery | Recipient email, Notification content | United States | Standard Contractual Clauses (Module 3) |
| Functional Software, Inc. (Sentry) | Error monitoring and diagnostics (processes only Handlo diagnostic data) | IP address, Diagnostic metadata | United States | Standard Contractual Clauses (Module 3) |
| Upstash, Inc. | Rate limiting and short-lived caching | Caller phone number, Cached assistant configuration, Transient call-session data, Aggregated analytics | European Union | EU hosting — no transfer outside the EEA |
| Google LLC | Calendar integration and Google Drive document ingestion (when enabled) | Calendar event data, Document content, Account data | United States | Standard Contractual Clauses (Module 3) |
| Microsoft Corporation | OneDrive & SharePoint document ingestion (when enabled) | Document content, Account data | United States / European Union | Standard Contractual Clauses (Module 3) |
| HighLevel, Inc. (GoHighLevel) | CRM sync to the Customer's connected GoHighLevel account (when enabled) | Contact identifiers, Lead / opportunity data, Call summary | United States | Standard Contractual Clauses (Module 3) |
| HubSpot, Inc. | CRM sync to the Customer's connected HubSpot account (when enabled) | Contact identifiers, Lead / deal data, Call summary | United States | Standard Contractual Clauses (Module 3) |
| IPQualityScore, Inc. (IPQS) | Caller phone-number reputation / spam scoring (Growth and Business tiers) | Caller phone number | United States | Standard Contractual Clauses (Module 3) |
| PostHog, Inc. | Product analytics (consent-gated; ingest reverse-proxied via /ingest) | Usage / event data, IP address, Pseudonymous user identifier | European Union | EU hosting — no transfer outside the EEA |
| Railway Corp. | Background worker / job-processing compute (exports, recordings, transcripts) | Contact identifiers, Call data, AI-generated data, Account data | European Union (europe-west4) | EU hosting — no transfer outside the EEA |
| Crisp IM SAS | Support live-chat widget | Contact identifiers, Support message content, IP address | European Union (France) | EU hosting — no transfer outside the EEA |
Informeremo i clienti con almeno 30 giorni di anticipo prima di aggiungere un nuovo sub-responsabile, come previsto dal nostro Addendum sul trattamento dei dati.