Subprocessors

1. How we select subprocessors

Before engaging any vendor that may process personal data, we assess its security practices, its compliance with the GDPR and other applicable data protection laws, and the contractual guarantees it offers.

All of them sign a data processing agreement requiring them to act only on our instructions, maintain confidentiality and report incidents.

2. Payments

PCI DSS certified payment processor: subscription processing, recurring billing and refunds. Processes name, email, billing data and transaction identifiers, operating in the United States and the European Union.

3. Infrastructure and storage

European hosting provider: running the application and its databases, including access logs.

Amazon S3-compatible object storage: files uploaded to the knowledge base and media exchanged in conversations.

Transactional email provider: account confirmations, password recovery, billing notices and product notifications.

4. Artificial intelligence providers

Used only when the AI answers or an AI feature is triggered. They receive only the prompt and conversation content, and are contractually prohibited from using it to train models.

• Anthropic: conversation handling and text generation.
• OpenAI: text generation, audio transcription and interpretation of images and documents, depending on the configured feature.

5. Messaging channels

The messaging channels operate with the customer's own credentials or pairing: WhatsApp through QR code pairing of the customer's own number, SMS through the customer's own Twilio account, and email through credentials the customer configures.

Message content transits these channels so the conversation can happen. Where the account belongs to the customer, that provider acts primarily under the customer's own agreement with it, and the platform transmits messages on the customer's instructions.

6. Integrations you authorize

Connected only with your express authorization, through each provider's official OAuth flow, and revocable at any time.

• Google (Calendar): receives the calendar events the AI creates on your behalf.
• Meta (Lead Ads): provides the lead form data you authorize the platform to retrieve.

7. Changes to this list

Before adding a new subprocessor that would handle customer personal data, we give at least 30 days' notice by email or in the dashboard.

If you have a reasoned objection, write to socio@sociosai.com. If we cannot resolve it, you may cancel your subscription without penalty and receive a pro-rata refund of the unused period.