ContigoBotSub-processors
Last updated: 21 October 2026. Translation; the Spanish text prevails.
Sub-processor list
Cloud Cost Control SL provides the Contigo services as processor for its customers (clinics, clubs and companies) and engages the sub-processors below. We give our customers 30 days' notice before adding or replacing one.
| Sub-processor | Purpose | Data | Where | Safeguard for transfers outside the EEA | Data processing terms |
|---|---|---|---|---|---|
| Cloudflare, Inc. (US) | Hosting and running the applications (Pages and Workers); database (D1), files (R2) and backups (D1 Time Travel, 30 days) | All service data | Database and files in the European Union. Applications run in the Cloudflare data centre nearest the user; technical logs may be processed in the US | EU-US Data Privacy Framework and, as fallback, standard contractual clauses (Decision (EU) 2021/914) | https://www.cloudflare.com/cloudflare-customer-dpa/ |
| Cloudflare, Inc.: Email Routing | Receiving email sent to service addresses, such as a clinic's lab results | Sender, recipient and email content | Cloudflare global network | As above | As above |
| Cloudflare, Inc.: Email Sending | Sending transactional email (access links, password resets, reminders and notices) | Recipient address and name, email content | Cloudflare global network | As above | As above |
| Cloudflare, Inc.: Workers AI | Transcribing staff voice notes, only if the customer enables voice import | Note audio | US or UK | As above | As above |
| Microsoft Ireland Operations Ltd (Microsoft group) | Sending transactional email from Contigo's corporate mailbox (Microsoft Graph) | Recipient address and name, email content, date | EU and US | EU-US Data Privacy Framework (Microsoft Corporation) and standard contractual clauses | https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA |
| Meta Platforms Ireland Limited (Ireland) | Sending and receiving WhatsApp messages (WhatsApp Business Cloud API) | Phone number, profile name, message content and date | EU, with transfers to Meta Platforms, Inc. and WhatsApp LLC (US) | EU contracting entity. US transfers under the Data Privacy Framework | https://www.facebook.com/legal/terms/Meta-Global-Processor-Terms |
| SpaceXAI LLC (xAI, US) | Grok model: interprets free-text WhatsApp messages and proposes the reply. Zero data retention (ZDR) active: xAI keeps nothing it is sent | Free text of messages and the customer's configuration | US | Standard contractual clauses (Decision (EU) 2021/914) | https://x.ai/legal/data-processing-addendum |
| Vapi Inc. (US) | Contigo Clínica voice assistant, only if the clinic enables it. Zero data retention (ZDR): Vapi keeps no recordings, transcripts or logs once a call ends | Caller number, audio and transcript during the call, client data the assistant looks up, call metadata | US | Standard contractual clauses (Decision (EU) 2021/914) | https://vapi.ai/terms-of-service (agreement at https://security.vapi.ai) |
| Stripe Payments Europe, Limited (Ireland, Stripe group) | Collecting fees, orders and subscriptions | Name, email, amount, description and payment data, entered directly on Stripe | EU and US | EU-US Data Privacy Framework (Stripe, LLC) and standard contractual clauses | https://stripe.com/legal/dpa |
Roles as independent controllers
Meta may process certain WhatsApp platform data as an independent controller for safety and integrity. Stripe acts as a processor to process payments and as an independent controller to prevent fraud, comply with anti-money-laundering and know-your-customer rules and respond to authorities and financial institutions.
Telegram
Contigo Club lets a club send notices on Telegram to adults who start its bot. Telegram is not a sub-processor: it processes its platform data as an independent controller (Telegram Messenger Inc., established outside the EEA) under its privacy policy (https://telegram.org/privacy) and offers no data processing agreement. Telegram says EEA users' data is stored in the Netherlands, but Telegram and its group companies (British Virgin Islands and Dubai) are outside the EEA, in countries without an adequacy decision, and Telegram is not in the Data Privacy Framework. So we only send on Telegram what is needed for the notice the person asked to receive there (Art. 49(1)(b) GDPR), with no health, minors' or payment data, and the club always offers WhatsApp or email as an alternative.
More information
The Data Privacy Framework list is at https://www.dataprivacyframework.gov/list. For more information write to damian@contigobot.com.