Subprocessors

1. How we select subprocessors

Before engaging any vendor that may process personal data, we assess its security practices, its compliance with the GDPR and other applicable data protection laws, and the contractual guarantees it offers.

All of them sign a data processing agreement requiring them to act only on our instructions, maintain confidentiality and report incidents.

2. Payments

PCI DSS certified payment processor: subscription processing, recurring billing and refunds. Processes name, email, billing data and transaction identifiers, operating in the United States and the European Union.

3. Infrastructure and storage

European hosting provider: running the application and its databases, including access logs.

Supabase: account authentication, database and file storage, including product materials and images uploaded by the customer.

Resend: delivery of the platform's transactional email, such as account confirmations, password recovery, billing notices and product notifications.

4. Artificial intelligence provider

Used only when the AI generates a message or an AI feature is triggered. It receives only the prompt and conversation content, and is contractually prohibited from using it to train models.

• OpenAI: generation of sales recovery, post-sale and reactivation messages, conversation handling and audio transcription, depending on the configured feature.

5. Sending channels connected by the customer

The sending channels operate with the customer's own credentials or pairing: WhatsApp through QR code pairing of the customer's own number, SMS through the customer's own Twilio account, and campaign email through the sending credentials the customer configures, such as their own Resend or SendGrid account.

Message content transits these channels so the sending can happen. Because the account belongs to the customer, that provider acts primarily under the customer's own agreement with it, and not as a subprocessor of Negoc.IA: the platform transmits messages on the customer's instructions.

6. Changes to this list

Before adding a new subprocessor that would handle customer personal data, we give at least 30 days' notice by email or in the dashboard.

If you have a reasoned objection, write to socio@sociosai.com. If we cannot resolve it, you may cancel your subscription without penalty and receive a pro-rata refund of the unused period.