Sub-processors

Last updated: 21 October 2026

Change on 21 October 2026: voice calls run on Apex's own voice server in Germany. Vapi has been removed from the list; the new sub-processors are Hetzner Online GmbH (hosting of the voice server), ElevenLabs (speech synthesis) and TypeSafe AI (caller intent recognition). These sub-processors only process data when the Voice product is used. Existing customers are notified by email as described below and may object within 14 days of the notice.

This page lists every third party that Apex Chatbot engages to process personal data on behalf of its customers. All sub-processors are bound by a Data Processing Agreement.

As a data processor ourselves, we rely on the following sub-processors to operate the service. Each sub-processor has been vetted for GDPR compliance and is bound by contractual obligations at least as protective as those we owe you. Transfers outside the EEA rely on Standard Contractual Clauses or the EU-US Data Privacy Framework.

Supabase, Inc.

Role: Database, authentication, edge functions

Location: EU (Frankfurt)

Data processed: Account data, chatbot conversations, audit log

Notes: Hosted in the EU; any remote access by the US provider is covered by the EU Standard Contractual Clauses

View DPA

OpenAI, OpCo, LLC

Role: Chatbot and voice agent reply generation, backup speech synthesis in voice calls

Location: USA

Data processed: Conversation text, chatbot messages, voice call transcripts

Notes: Transfer outside the EEA under the EU Standard Contractual Clauses

View DPA

Anthropic PBC

Role: Optional model routing (only when explicitly enabled)

Location: USA

Data processed: Conversation text (only when enabled)

Notes: Transfer outside the EEA under the EU Standard Contractual Clauses

View DPA

Stripe Payments Europe Ltd.

Role: Payments and subscription management

Location: Ireland (EU) with US fallback

Data processed: Billing data, payment metadata

Notes: Transfers to the USA under the EU Standard Contractual Clauses and the EU-US Data Privacy Framework

View DPA

Resend Software, Inc.

Role: Transactional email delivery

Location: USA

Data processed: Email address, email content

Notes: Transfer outside the EEA under the EU Standard Contractual Clauses

View DPA

Cloudflare, Inc.

Role: Application hosting (Workers), CDN, DNS and edge security for apexchatbot.com

Location: USA with global edge

Data processed: Application traffic, IP addresses, request metadata

Notes: Transfers under the EU-US Data Privacy Framework and the EU Standard Contractual Clauses

View DPA

Hetzner Online GmbH (Apex voice server)

Role: Hosting of Apex's own voice server, which runs browser and telephone voice calls with a self-hosted real-time media server (only when the Voice product is used)

Location: EU (Germany, Nuremberg)

Data processed: Voice call audio, transcripts and call metadata (phone numbers, timestamps)

Notes: Apex's own voice server in Germany; no transfer outside the EEA

View DPA

Soniox, Inc.

Role: Real-time speech-to-text used by the Voice product

Location: USA

Data processed: Voice call audio for real-time speech recognition

Notes: Transfer outside the EEA under the EU Standard Contractual Clauses

View DPA

ElevenLabs

Role: Speech synthesis, the voice of the voice agent (only when the Voice product is used)

Location: USA

Data processed: Text of the voice agent's replies, converted to speech

Notes: Transfer outside the EEA under the EU Standard Contractual Clauses

View DPA

TypeSafe AI, Inc.

Role: Recognizing the caller's intent in voice calls (only when the Voice product is used)

Location: USA

Data processed: Masked call text (email addresses, phone numbers, dates, other numbers and credentials are masked before sending)

Notes: Receives only masked text; transfer outside the EEA under the EU Standard Contractual Clauses

Telnyx LLC

Role: Telephone numbers, call routing, and SMS verification for callbacks

Location: USA with global telecommunications infrastructure

Data processed: Phone numbers, call routing metadata, callback verification data

Notes: Telecommunications and verification terms also apply; transfer outside the EEA under the EU Standard Contractual Clauses

View DPA

Notification of new sub-processors

We will notify the Customer at least 14 days in advance of adding a new sub-processor. Notification is sent by email to the account owner.

Right to object

The Customer may object to a new sub-processor by emailing dpo@apexweb.hu within the notice period. If the objection cannot be resolved, the Customer may terminate the subscription with a pro-rata refund for the unused period.