Sub-processors

How to read this list

Each provider is here because it is needed for the service to work. All of them process data solely to provide their service to us, under a processing agreement, and none uses it for their own purposes.

Those outside the European Union receive data under the Standard Contractual Clauses approved by the European Commission and, where certified, under the EU-US Data Privacy Framework.

Infrastructure and data

Where the database, the files and the pages live.

• Supabase: database, authentication, file storage and realtime. Processes practically all service data. Location: European Union (Ireland).
• Vercel: hosting of ronus.tech, the admin panel and the app's public layer. Processes traffic data and whatever travels in each request. A US company; the deployment runs in its Frankfurt (Germany) region.
• Cloudflare: content delivery network and secure access to our servers. Processes connection metadata. Location: United States.
• Hetzner: the virtual private server running the workflow orchestrator that governs the assistant and our business API, with its own database. The conversational memory lives there. Location: Germany (Nuremberg).

Conversation channels

Where messages and calls come in and go out.

• Twilio: WhatsApp, SMS and phone number verification. Processes phone numbers and message content. Location: United States.
• Zoho: transactional email to businesses and to people who use the app (notices, receipts, the recovery email code, the notice before deletion for inactivity) and receipt of the ronus.tech forms. Processes email addresses and message content. Location: the account is hosted in its European Union region.

Artificial intelligence

Who drafts the replies. Exactly what it receives is detailed in section 9 of the privacy policy.

• OpenAI: language models for the conversational assistant, the insights panel and the ronus.tech chat. Processes conversation content, the writer's number and profile name, the business catalogue and, in the website chat, the text typed by the visitor. Customer data reaching the insights panel is pseudonymised. Location: United States.

Payments

Who moves the money. Card details never pass through our systems.

• Stripe: collection of subscription fees and appointment deposits. Processes payment data, amounts and billing identifiers. Location: United States and Ireland.

Mobile application

What is needed for the app to exist on a phone.

• Expo: push notifications and app builds. Processes device identifiers and the text of every alert sent. Location: United States.
• Apple: App Store and iPhone notifications. Processes device and account identifiers and, for notifications, the text of every alert. Location: United States.
• Google: Google Play and Android notifications. Processes device and account identifiers and, for notifications, the text of every alert. Location: United States.
• OpenStreetMap (Nominatim): geocoding of the business address. The lookup is made by the device of whoever opens a business page with a map, not by the business sign-up. It receives the business address and that device's IP. Location: European Union.
• CARTO and unpkg: tiles and library for the map the app renders. They are downloaded by the device of whoever opens the page, so they receive its IP address and the map area viewed. Location: United States and European Union.

Internal operations

These do not receive your end customers' data, but they do receive confidential information about your business, so they are listed anyway.

• Google Drive: storage of each assistant's configuration scripts, which contain your commercial profile and service protocol. Location: United States.
• Telegram: internal operational alerts to the RONUS team (client identifier and process status). Location: outside the European Union.
• GitHub: source code and deployment automation. Does not process end customers' personal data. Location: United States.

Announced in advance (not yet receiving data)

Article 28(2) requires notice of a new sub-processor in time to object. These are decided and announced here before being switched on; today they receive no data.

• VAPI: will handle voice calls once that channel is activated, with real-time call audio and its transcript. Location: United States. The privacy policy will be updated before the switch-on.

Changes to this list

When we add or remove a sub-processor we will update this page and email clients subscribed to change notices, at least 30 days in advance unless an urgent security change requires moving faster.

If you object on reasonable grounds to a new sub-processor, write to legal@ronus.tech within those 30 days. We will look for a reasonable alternative and, if there is none, you may terminate the contract without penalty and with a pro-rated refund of the unused portion.

Contact

Contracts, DPA and change notices: legal@ronus.tech · Privacy: privacy@ronus.tech.