Sub-processors
These are the service providers we use to run norlin for our customers. Each works under a data processing agreement with us. We inform customers in writing before we add a new sub-processor.
| Provider | Purpose | Data | Location | Transfer basis |
|---|---|---|---|---|
| Hetzner Online GmbH | Servers, database, backups and file storage | All platform data, stored encrypted; campaign avatar images (no lead data) in file storage | Germany | EU provider |
| Anthropic, PBC | AI model that writes the agent's replies | First name, conversation messages, page context for greetings | USA | EU Standard Contractual Clauses |
| OpenAI, Inc. | Alternative AI model, chosen per campaign | First name, conversation messages, page context for greetings | USA | EU Standard Contractual Clauses |
| Resend, Inc. | Email delivery | Email addresses, email content, delivery data | USA | EU Standard Contractual Clauses |
| HubSpot, Inc. | Meeting booking in the customer's HubSpot calendar | Name, email address, time zone | USA | EU Standard Contractual Clauses and EU-U.S. Data Privacy Framework |
What reaches the AI provider
- Our system adds only the visitor's first name and the conversation to an AI request. Email addresses, phone numbers and last names are never added.
- Visitors may still type personal details into a message themselves; those are part of the conversation.
- The AI providers keep requests for abuse monitoring for a limited time (Anthropic 7 days, OpenAI up to 30 days) and do not use them to train models.
- Booking details go from our database straight to HubSpot, not through the AI.
- All conversations and lead data are stored in Germany.
Customers can request our data processing agreement, including the technical and organisational measures, at development@khal.it.
This English version is provided for convenience. The German version is legally binding.