Sub-processors

Last updated: October 3, 2026

v1.2

Bota is operated by Zentia Labs LLC. To deliver the service we rely on the providers listed below. Each one processes only the category of data needed for its function and under signed Data Processing Agreements (DPA / SCCs) with Bota. This list is updated whenever our dependencies change.

1. Infrastructure and hosting

Google LLC — Google Cloud Platform

  • Services: Cloud Run (compute), Cloud Storage (files) and Cloud Tasks (job queues).
  • Data processed: all application data in transit; in Cloud Storage, the attachments sent by end customers and call recordings and transcripts.
  • Region: compute in europe-west1 (Belgium); storage in the European Union multi-region.
  • Legal framework: Google Cloud DPA + EU Standard Contractual Clauses.

Neon Inc. (on Amazon Web Services)

  • Service: production PostgreSQL database.
  • Data processed: all application data (conversations, end customer contact details, tenant configuration, operator accounts, call transcripts).
  • Region: eu-central-1 (Frankfurt, Germany).

Upstash, Inc.

  • Service: cache and temporary storage (Redis): usage limits, conversation locks and queues, real-time dashboard events, and translation and configuration caches.
  • Data processed: visitor IP addresses, pseudonymous visitor identifiers and conversation metadata, with a short expiry.
  • Region: European Union (Belgium, europe-west1).

Hetzner Online GmbH

  • Service: fixed-IP outbound proxy to the booking systems (RMS) that require an allow-listed IP address.
  • Data processed: the booking data sent to the customer’s RMS (end customer name, email and phone number, dates).
  • Region: Germany (Nuremberg).

2. AI and model orchestration

OpenAI, L.L.C.

  • Service: GPT models (primary provider for the conversational agent and for classification, extraction and translation in the operator dashboard), knowledge base embeddings and, on the phone channel with the Bota voice engine, the real-time voice model. Direct call to api.openai.com, no intermediaries.
  • Data processed: prompts and conversation content at inference time; on calls handled by the Bota voice engine, the call audio.
  • Commitment: the OpenAI API does not train models on data submitted via API (API data usage policy).
  • Location: United States.

Google LLC — Gemini (Vertex AI and Gemini API)

  • Service: Gemini models to check the coherence of agent replies, analyse attachments (images and documents), transcribe voice notes and call recordings, translate texts, run the voice agent and extract data from PDFs the operator uploads. Primary: Vertex AI, in Bota’s Google Cloud project; fallback: Gemini API (generativelanguage.googleapis.com).
  • Data processed: message and conversation content, attachments and audio sent by end customers, and documents the operator uploads.
  • Commitment: Google does not use data submitted via API to train its models (Vertex AI and paid Gemini API terms).
  • Location: European Union (europe-west1, Belgium) for most tasks; the coherence checker uses Google’s global endpoint, which may process data in other regions, including the United States. The fallback Gemini API: United States.

OpenRouter, Inc.

  • Service: fallback LLM inference provider. Serves OpenAI, Google and Anthropic (Claude Haiku 5.5) models when the primary provider does not respond. OpenAI models are served first through Microsoft Azure or Amazon Bedrock, and through OpenAI last. Direct call to openrouter.ai/api/v1.
  • Data processed: prompts and conversation content at inference time, only when the fallback is triggered.
  • Commitment: no-training policy for API users; underlying providers (Anthropic, etc.) operate under their own DPAs and no-training policies.
  • Location: United States.

3. Maps

Google LLC — Google Maps Platform

  • Service: geocoding of the place the end customer gives to find the nearest office, and images and maps of the customer’s offices.
  • Data processed: the location text the end customer types (which may be an address) and the office addresses.
  • Location: United States.

4. Messaging and communications

Meta Platforms Ireland Ltd. — WhatsApp Cloud API, Messenger and Instagram

  • Service: send and receive WhatsApp, Messenger and Instagram messages on behalf of the tenant.
  • Data processed: end customer phone number or identifier, message content and delivery metadata.
  • Location: European Union (controller: Meta Platforms Ireland).

Resend, Inc.

  • Service: transactional emails (account verification, notices to the customer’s team when a conversation is handed over to a person, operational alerts, data requests and support).
  • Data processed: recipient email address and message content; the handover notice includes the end customer’s latest messages.
  • Location: United States.

LiveKit, Inc. — LiveKit Cloud

  • Service: transport for SIP connection calls. The customer’s phone system (PBX) hands the call to LiveKit, which carries it in real time to Bota’s voice agent and, if it is transferred, back to the phone system. It also carries the audio when an operator picks up one of those calls in the browser.
  • Data processed: caller number, call audio in transit and, when the call is picked up in the browser, the operator’s voice and IP address. LiveKit does not record or keep the audio: recording, when enabled on the channel, is done by Bota’s voice agent and stored in Google Cloud.
  • Location: LiveKit Cloud’s global network; the call enters through the region closest to its origin, so it may be processed outside the European Union, including in the United States.

5. Payments

Stripe, Inc.

  • Service: payment processing, invoicing and collection from the tenant.
  • Data processed: tenant billing data and payment details (Stripe is the direct controller of card and bank account data; Bota never receives them).
  • Location: United States.

6. Support and customer relations

Odoo S.A.

  • Service: management of support tickets and demo requests.
  • Data processed: operator email and name, tenant name, the text of the request and its attachments (which may contain end customer data if the operator includes it).
  • Location: the Americas (production database); backups in Europe and Canada.

7. Observability and product analytics

Functional Software, Inc. — Sentry

  • Service: error tracking for the server, the operator dashboard and the web widget.
  • Data processed: error traces and messages, session identifiers, IP address and browser; in the widget, a sample of session recordings with text and form fields masked.
  • Location: European Union (Germany data region).

PostHog Inc.

  • Service: product analytics for the operator dashboard and operational metrics for conversations.
  • Data processed: operator usage events (with masked session recording while the support dialog is open) and pseudonymous conversation events (conversation identifier, encrypted visitor identifier, channel and language), without message text.
  • Location: EU cluster (data does not leave the EU).

8. Providers contracted by the customer

Some services used by Bota are contracted and paid for directly by the customer, under its own account, and act as the customer’s processors, not as sub-processors of Zentia Labs: the telephony carrier for the phone and SMS channel (for example, Telnyx, together with the speech recognition and speech synthesis engines it offers within the customer’s account; the phone number always sits in the customer’s account), the phone system and carrier the customer uses for the SIP connection, and the customer’s booking management system (RMS). Bota connects to them using the credentials the customer provides.

9. International transfers

For sub-processors located outside the European Economic Area (United States), Bota relies on the Standard Contractual Clauses approved by the European Commission (Decision 2021/914/EU) and, where applicable, on the EU-US Data Privacy Framework. Each US-based sub-processor maintains its own Data Processing Addendum with Bota.

10. Change notification

Before adding a sub-processor or materially changing what it processes, we update this page and the header date and notify customers by email with reasonable advance notice. The customer may object on reasonable, justified grounds by writing to privacy@bota-chat.com.

Contact

Controller
Zentia Labs LLC

This list complements the Privacy Policy. For detail on GDPR roles, retention, and data subject rights, see also the privacy page and the data deletion page.