Sub-processors
Version 2026-10-31
The providers that process personal data so ISSA works: what they do, where they are and what data they receive.
1. What a sub-processor is
A provider that processes personal data on our behalf to provide the service. Each one is bound by contract to confidentiality, to security measures and to process data only on our instructions.
2. List of sub-processors
These are the sub-processors we use today:
| Provider | Purpose | Location | Data |
|---|---|---|---|
| Hostinger | Hosting of the servers, the database and the encrypted backups. | United States | All service data. |
| Cloudflare | Delivery network, DNS, attack protection, bot check (Turnstile) and inbound email routing. | Global network; based in the United States | IP address, technical request data and emails received at holaissa.com. |
| Anthropic | AI models (Claude) that write the assistant replies, setup proposals and improvement suggestions. | United States | Conversation messages, the contact name and the business and catalog information. |
| Groq | Voice note transcription. | United States | Voice note audio and its transcript. |
| Vapi | Voice calls with the assistant, if the business turns them on. | United States | Phone number, call audio and transcript. |
| Meta (WhatsApp, Messenger, Instagram) | Messaging channels the business connects; Meta runs them under its own terms. | United States and Ireland | Messages, identifiers and profile names of contacts. |
| Resend | Sending service emails (sign-in, notices, invoices, renewals). | United States | Email address, name and email content. |
| Stripe | Card payments and subscription management. | United States | Name, email, card details (Stripe receives them; ISSA never sees the full number) and payment history. |
| Facturama | Issuing Mexican electronic invoices (CFDI). | Mexico | The customer tax id (RFC), legal name, tax regime, postal code, email and invoiced items. |
| Expo | Push notifications of the mobile app. | United States | The device push token and the notification text, which can include the name of a contact. |
3. Integrations you turn on
These services only receive data if you connect them, and are governed by your own terms with them:
- Google Calendar: appointments (name, phone, date and reason) in the calendar you choose.
- Zoho CRM: the leads, stages and notes you sync.
- Your webhooks and the open API: the data you choose, sent to the systems you set up.
- Your own Anthropic key, if you register it: your assistant’s conversations are processed under your contract with Anthropic.
4. Software we run ourselves
WhatsApp QR linking uses Evolution API, open-source software we run on our own servers; it is not a third party that receives data. The same goes for the service’s database and queues.
5. International transfers
Most sub-processors are in the United States. For data from the European Economic Area and the United Kingdom we rely on standard contractual clauses and their addenda; for Brazil, on the ANPD standard clauses; and in every case on contractual commitments of equivalent protection.
6. Changes and objections
We will email owners and update this page at least 15 days before adding or replacing a sub-processor. If you have a reasonable data protection objection, write to [email protected]; if we cannot find a solution, you can terminate the service without penalty.
