Version: 1.1
Date: 16/06/2026
Preamble
This list supplements the Privacy Policy and the Data Processing Agreement (DPA) between Traction Group S.r.l. (“Processor”) and its Customers (“Controllers”). It indicates the third-party providers (subprocessors or independent controllers, as the case may be) that Traction Group relies on to deliver the AISA Service.
Data is hosted and stored in the European Union (Cloud.it servers, Italy). Transfers to providers outside the EEA are covered by the safeguards required under Chapter V GDPR — Standard Contractual Clauses (SCC) and/or adherence to the EU-US Data Privacy Framework — and each provider is bound by a data processing agreement (DPA).
Providers active for the base service
Providers that Traction Group relies on to deliver the standard features of the AISA Service.
| Provider | Purpose / Service | Privacy role | Data categories | Location | Transfer outside the EU |
|---|---|---|---|---|---|
| OpenAI API | Processing of conversation content through AI models to generate the assistant's responses | Subprocessor | Conversation content (may include personal data entered by end users) | USA | SCC. Data not used for training; limited retention (up to 30 days) for security/abuse purposes only, then deleted |
| Google Gemini API | Support for automatically generating the assistant's initial configuration during onboarding | Subprocessor | Name, email, company, phone, website | USA | SCC and/or DPF. Paid plan: data not used for training |
| Google Sheets | Temporary spreadsheet for onboarding/lead data (on a transitional basis) | Subprocessor | Name, email, company, phone, website | USA | SCC and/or DPF |
| Stripe | Payment and billing management | Independent controller for part of the processing | Name, email, address, phone, VAT number/Tax Code, subscription data | USA | SCC and/or DPF |
| Meta — Ads / Lead Ads | Advertising campaigns and lead acquisition | To be qualified separately from WhatsApp messaging | Data provided by the user via form, campaign identifiers, advertising metadata | USA | SCC |
| Zapier | Automation/integration of lead-acquisition flows from campaigns | Subprocessor | Name, email, company, phone, website | USA | SCC |
| Infobip | Sending emails and messages (e.g. notifications, communications) to Customers | Subprocessor | Email, phone number, communication content | EU | None (data in the EU) |
| MailerSend | Sending transactional emails and communications | Subprocessor | Email, name, communication content | US entity; data hosting in the EU (Belgium) | EU-US Data Privacy Framework + DPA |
| Cloud.it | Infrastructure hosting and storage of data at rest | Subprocessor | All processed data (at rest) | EU (Italy) | None (data in the EU) |
Providers active only if the Customer enables optional features
Providers involved only when the Customer activates specific additional features.
| Provider | Purpose / Service | Privacy role | Data categories | Location | Transfer outside the EU |
|---|---|---|---|---|---|
| Meta — WhatsApp Business Platform | WhatsApp messaging channel, only if enabled by the Customer | To be qualified according to the contractual and technical configuration | Phone number, message content, technical conversation metadata | USA | SCC |
Future / not-yet-active providers or channels
Channels and providers not yet active: they will be added to the list with the relevant safeguards before activation.
| Provider / Channel | Purpose / Service | Privacy role | Status |
|---|---|---|---|
| Meta — Messenger / Instagram | Additional messaging channels | To be qualified upon activation | Not yet active |
| Telegram, Slack, Microsoft Teams | Additional messaging channels | To be qualified upon activation | Not yet active |
Components not considered subprocessors
The following software components are self-hosted within Traction Group's infrastructure (Cloud.it servers, EU), do not involve disclosing data to third parties and therefore do not constitute subprocessors: authentication (SuperTokens), search engine (Typesense), automation orchestrator (n8n), internal CRM (Autocust), database (PostgreSQL), cache (Redis) and the content crawler. Any communications to third parties take place solely through the providers listed in the table.
Changes and notification (GDPR Art. 28(2))
Traction Group may add or replace subprocessors for the needs of the Service. In that case, it will inform the Customers (Controllers) with reasonable notice, as a rule at least 15 days before activating the new subprocessor, via email to the account administrator and by updating this page with the updated date and version number. The Customer may object to a new subprocessor for reasonable and documented data-protection reasons, as provided for in the DPA.
Version history
- 1.1 (16/06/2026) — Added “Privacy role” column; separation between active, optional and future providers; distinct rows for Meta WhatsApp and Meta Ads/Lead Ads; more precise service names; 15-day notice for new subprocessors.
- 1.0 (16/06/2026) — First publication of the list.
For questions or to exercise your rights: [email protected] or via PEC (certified email) [email protected].