Sub-processors
Last reviewed: September 29, 2026
This is the list of providers that process personal data on behalf of CitaFlow (Lince Media LLC) to deliver the Service to our customers, under Article 28(2) GDPR. It forms part by reference of the Data Processing Agreement (DPA) and complements Section 6 of the Privacy Policy.
1. Current list
| Entity | Service provided | Processing location | Transfer mechanism |
|---|---|---|---|
| Supabase, Inc. (US) | Database, authentication and file storage | European Union (Paris, France) | Data hosted in the EU. Provider DPA; Standard Contractual Clauses (2021/914) for support access from outside the EEA |
| Hetzner Online GmbH (Germany) | Servers for the admin panel, API, website, link shortener and self-hosted internal tools (n8n, Chatwoot, Umami) | Germany (Falkenstein) | No international transfer. Provider DPA |
| Railway Corp. (US) | Voice assistant server | United States | Standard Contractual Clauses (2021/914), encryption in transit and at rest |
| Cloudflare, Inc. (US) | CDN, perimeter protection, bot verification (Turnstile) and custom domains | Global network; configuration in the United States | EU-U.S. Data Privacy Framework; Standard Contractual Clauses as fallback |
| Twilio Inc. (US) | Phone numbers and voice calls; transactional email (SendGrid) | United States and the number's local carriers | EU-U.S. Data Privacy Framework; Standard Contractual Clauses as fallback |
| OpenAI OpCo, LLC (US) | Real-time voice, audio transcription and semantic indexing, only when the Customer enables AI features. Business API: no use of the data to train models | United States | Standard Contractual Clauses (2021/914) incorporated into the provider's DPA; not certified under the Data Privacy Framework |
| Google LLC (US) | Gemini models for the chat assistant and content moderation; Firebase Cloud Messaging (push notifications); Google Places (business verification at sign-up) | United States and European Union depending on the service | EU-U.S. Data Privacy Framework; Standard Contractual Clauses as fallback |
| TypeSafe AI, Inc. (US) | Jev classifier: attention needs and outcome of chat conversations, voicemail topic and urgency, CSV header matching. Emails and long numeric patterns are replaced before sending | United States | Standard Contractual Clauses (2021/914) with supplementary measures |
| Stripe, LLC (US) and Stripe Payments Europe, Ltd. (Ireland) | Payments and subscription management (PCI DSS Level 1) | United States and Ireland | EU-U.S. Data Privacy Framework; Standard Contractual Clauses as fallback |
| Sendinblue SAS (Brevo) (France) | CitaFlow's email marketing and sales CRM (leads and accounts) | European Union (France) | No international transfer |
| TOPefekt s.r.o. (BulkGate) (Czechia) | SMS delivery | European Union (Czechia) and destination-country carriers | No international transfer by the provider; the destination carrier depends on the number |
| Functional Software, Inc. (Sentry) (US) | Application error monitoring, with content masking | United States | EU-U.S. Data Privacy Framework; Standard Contractual Clauses as fallback |
| Axiom, Inc. (US) | Technical service logs | United States | Standard Contractual Clauses (2021/914) with supplementary measures |
The mechanism shown is the one in force on the review date. Where the EU-U.S. Data Privacy Framework is indicated, the provider states its certification in its own privacy policy (checked on September 29, 2026) and we keep the Standard Contractual Clauses as a fallback safeguard. Transfers from the United Kingdom rely on the UK Extension to the DPF or on the ICO's International Data Transfer Addendum, depending on the provider.
2. What is not a sub-processor
- Meta Platforms (WhatsApp, Instagram, Facebook Messenger) and Telegram: when a business enables those channels, the channel provider processes the messages as an independent controller under its own terms.
- Telecommunications carriers underlying the phone numbers (for example Enreach Communications S.L.U. for Spanish numbers): they process metadata and regulatory obligations as independent controllers.
- Self-hosted tools on our Hetzner servers (n8n, Chatwoot, Umami): they are not external recipients of data.
3. Changes to the list and right to object
We give at least 14 days' notice of each new sub-processor by email to the account administrators and update this page with the new review date. If a replacement is urgent for security or Service continuity reasons, we give notice without delay, even if with less lead time. Switching model or product within an already listed provider is not an addition. The Customer may object on reasonable grounds within that period; if no viable alternative exists, the Customer may terminate the affected part of the Service without penalty, as set out in Section 6 of the DPA.
To receive the notices at another address, write to privacy [arroba] citaflow [punto] com with the subject "Sub-processors".
4. Change history
- September 29, 2026: list published with processing location and transfer mechanism per provider, checked against each provider's policy. All providers were already listed in Section 6 of the Privacy Policy.