Sub-processors
As required by Art. 28(2) GDPR, this is the current list of sub-processors engaged by Mignuti Chatbot. Customers may subscribe to receive 30-day advance notice of changes via media@mignuti.com.
| Sub-processor | Role | Location | Data processed | Transfer |
|---|---|---|---|---|
| netcup GmbH (Germany) | Server hosting (self-hosted Supabase stack: DB, Auth, Edge Functions, Storage) | EU (Germany) | Primary platform data | EU-AVV |
| Anthropic PBC | LLM (Claude Haiku 4.5) | USA | Chat messages (PII automatically redacted before transfer) | EU SCCs 2021/914 |
| Azure OpenAI Service | LLM Fallback (GPT-4o-mini) | EU (Sweden/Germany) | Chat messages (PII automatically redacted before transfer, no training) | Microsoft-EU-AVV |
| OpenAI | Embeddings (text-embedding-3-small) | US (SCC) | Query and document embeddings (PII-redacted) — no full chat transcripts | EU-SCCs 2021/914 |
| Meta Platforms Ireland Ltd. | WhatsApp Business Platform (channel, optional per project) | Ireland/EU, transferred to the USA | Phone number, message content and timestamp of the WhatsApp conversation | EU-US DPF + EU SCCs 2021/914 |
| Stripe | Billing + Payments | Ireland/EU | Billing data | EU-AVV |
| Cloudflare (incl. Turnstile) | CDN + Widget hosting + Bot captcha + error reports and audience measurement (our own services bugd.one, trackd.one) | Global (EU preferred); error reports EU | Widget asset delivery, logs, captcha tokens, error reports (shortened, no IP), marketing-site page views (no cookies, no IP) | EU-SCCs 2021/914 |
| Resend | Transactional email (system and operator notifications, billing notices, form submissions) | USA | Email addresses and the content of the respective message | EU SCCs 2021/914 |
Sovereign operation (Enterprise, on request)
For projects with their own AI model, answers and search run on a language model on dedicated hardware in Germany or in the customer's own infrastructure. Anthropic, OpenAI and Azure OpenAI are then not used, not even as a fallback. If the model is unavailable, the bot pauses. Still involved are netcup (hosting), Cloudflare (delivery of the widget file and the admin interface) and Resend for login and invitation emails. On request we switch off notification emails and the WhatsApp channel (Meta); with invoice billing, Stripe is not used. The contract annex “Sovereign operation” names where the hardware is run before the contract starts.
Last updated: 2026-05-13 (section Sovereign operation: 2026-10-13).