Konfi Labs d.o.o. uses the following subprocessors to provide the Konfi service. Each processes personal data only to the extent described below, under a data processing agreement with us, and — where data leaves the EU/EEA — under an approved transfer mechanism (EU–US Data Privacy Framework certification and/or Standard Contractual Clauses).

We notify clients of planned subprocessor additions or replacements in advance, as set out in our Data Processing Agreement. To be notified of changes to this list, email privacy@konfi.ai.

Infrastructure

Subprocessor	Purpose	Personal data involved	Location
Hetzner Online GmbH	Hosting: servers, database, backups	All service data	Germany / Finland (EU)
Sentry (Functional Software, Inc.)	Error monitoring	Technical error context; may incidentally include identifiers in error payloads	EU region

Messaging channels

Channel platforms deliver messages between the attendee and Konfi. The attendee’s own relationship with the platform (e.g. their WhatsApp account) is governed by the platform’s terms; the rows below cover the business-side message routing we use.

Subprocessor	Purpose	Personal data involved	Location
360dialog GmbH	WhatsApp Business API provider (BSP)	Phone number, message content, delivery metadata	Germany (EU)
Meta Platforms (WhatsApp)	WhatsApp message transport (via 360dialog)	Phone number, message content, delivery metadata	US / global — DPF + SCCs
Telegram	Telegram bot message transport	Telegram user ID, message content	Global
Infobip Ltd.	Apple Messages for Business (pending launch)	Opaque Apple conversation ID, message content	Croatia (EU)
Sinch (Mailgun)	Email sending and receiving	Email address, message content, delivery metadata	EU region (pinned)

AI model providers

Both providers are used via their commercial APIs, whose terms exclude training on submitted data. Conversation content is sent to generate the agent’s replies and analysis, and is retained by the provider only per their standard API retention policy. Neither provider is certified under the EU–US Data Privacy Framework (checked 2026-08-06); transfers rest on Standard Contractual Clauses incorporated in each provider’s data processing agreement.

Subprocessor	Purpose	Personal data involved	Location
Anthropic	LLM inference (agent reasoning and replies)	Conversation content, event context provided to the agent	US — SCCs
OpenAI	LLM inference (selected tasks, e.g. embeddings, vision)	Conversation content or media for the specific task	US — SCCs

Enrichment & integrations

Subprocessor	Purpose	Personal data involved	Location
Google (OAuth, Maps/Places)	Organizer sign-in; venue and location enrichment	Organizer email (OAuth); place queries (no attendee identity)	US — DPF

Auxiliary lookup services the assistant uses (public-website content for the knowledge base, flight schedule lookups) receive no personal data — queries are made without attendee identity — and are therefore not subprocessors.

Registration platform integrations (e.g. Sessionize, Luma, Zuddl) act on the organizer’s behalf: the organizer connects their account and instructs the transfer of registration data to Konfi. They are the organizer’s processors, not ours, and are therefore not listed above.

Changes to this list: material changes are announced to clients with at least 14 days’ notice before the new subprocessor processes client personal data.