The companies behind the system.

How this list works

Last updated: 17 October 2026

A subprocessor is a company we use that may handle your customers' data while we run your system for you. Each part of the system gets only the data it needs. For each one we show:

• Purpose: what it does for you.
• Data: what it may see.
• Location: the company, its country and where it keeps or processes data.
• Transfer basis: how data sent outside Turkey is covered under KVKK and GDPR.

We send each provider only what it needs for its task, and it handles that data under its own business terms to provide its service to us.

Several of these providers are outside Turkey, so personal data is transferred abroad. Under KVKK Article 9 (as amended in 2024) we rely on the providers' standard contractual clauses, or on explicit consent where that is required.

Accounts you hold and pay for yourself, such as your own Meta ad account or your own calendar, run under your own terms with that company and are not on this list.

Messaging

Meta (WhatsApp, Instagram, Messenger)

• Purpose: delivers messages between your customers and your business accounts through the WhatsApp Business Platform, Instagram and Facebook Messenger.
• Data: messages, voice notes, photos and files, names, phone numbers and profile names.
• Location: Meta Platforms · processed on Meta's own infrastructure, outside Turkey.
• Transfer basis: Meta's standard contractual clauses, or explicit consent where required. Your accounts stay in your name, so Meta may also be your own provider under your own terms with Meta.

Zernio (channel connection)

• Purpose: a messaging API provider that connects your WhatsApp, Instagram and Messenger accounts to our system, so messages come in and replies go out.
• Data: the same as Meta: messages, files, names and numbers.
• Location: Zernio · processed on Zernio's servers, outside Turkey.
• Transfer basis: standard contractual clauses, or explicit consent where required.

Automation and storage

n8n (automation)

• Purpose: runs the steps of your system: reads each message, asks the AI model, sends the reply, alerts your team, books the appointment.
• Data: everything that passes through: messages, contact details, booking data and, for clinics, photos and health details.
• Location: n8n GmbH, Germany · n8n Cloud, hosted in the EU (Germany).
• Run history: kept only as long as we need it to check that the system works, and deleted or returned within 30 days after your contract ends.
• Transfer basis: standard contractual clauses, or explicit consent where required.

Supabase (database and file storage)

• Purpose: stores your approved answers, conversations, bookings and settings.
• Files: also stores the photos and files patients send, in private storage only your team can open.
• Data: all the types listed in our DPA, including photos and health data for clinics.
• Location: Supabase, Inc., USA · our project currently runs in the Tokyo, Japan region. We plan to move it to the EU.
• Transfer basis: standard contractual clauses, or explicit consent where required.

AI models

Google Gemini

• Purpose: reads incoming messages and writes replies from your approved answers, in the customer's language. Also used for translation, language detection, voice notes and speech.
• Data: the message, the conversation so far and the approved answers that fit. Voice notes are sent so they can be understood and answered.
• Plan: used through Google's Gemini API, not the consumer Gemini app. Live client systems run on the paid plan, where Google does not use the data to improve its products.
• Location: Google LLC, USA · processed on Google's servers, outside Turkey.
• Transfer basis: standard contractual clauses, or explicit consent where required.

Anthropic Claude (interpreter app)

• Purpose: the AI model behind our interpreter app.
• Data: the text of the conversation being interpreted.
• Location: Anthropic PBC, USA · processed in the USA.
• Transfer basis: standard contractual clauses, or explicit consent where required.

OpenAI (speech-to-text)

• Purpose: turns speech into text in our interpreter app.
• Data: the spoken audio of the conversation being interpreted.
• Location: OpenAI, L.L.C., USA · processed in the USA.
• Transfer basis: standard contractual clauses, or explicit consent where required.

Booking and alerts

Cal.com (booking)

• Purpose: keeps your calendar of free times and the bookings the assistant makes. Used only when you switch booking on.
• Data: name, contact details, appointment time, the service asked about and time zone.
• Location: Cal.com, Inc., USA · processed outside Turkey.
• Transfer basis: standard contractual clauses, or explicit consent where required. If you use your own Cal.com account, Cal.com is your provider, not ours.

Telegram (team alerts)

• Purpose: sends alerts and questions to your team's private group: questions the assistant can't answer, requests for a person, and replies waiting for approval.
• Data: the customer's name or number, their question and the suggested reply.
• Photos and health details are not sent in alerts. Your team opens them through a private link.
• Location: Telegram Messenger Inc., UAE · processed on Telegram's servers, outside Turkey.
• Transfer basis: standard contractual clauses, or explicit consent where required.

Email and website

Email hosting (wildzero.works)

• Purpose: our email at wildzero.works, for messages between you and us, and reports if you get them by email.
• Data: your team's names and email addresses, and whatever you send us by email. Please don't email us patient details.
• Location: our email hosting provider · servers may be outside Turkey.
• Transfer basis: standard contractual clauses, or explicit consent where required.

Cloudflare (website hosting and app server)

• Purpose: hosts our website, protects it from attacks, and runs the server of our interpreter app (Cloudflare Workers).
• If we build and host a website for you, it runs here too.
• Data: IP addresses, browser details and request logs of visitors (time and requested page), whatever a website form sends, and the interpreter app's traffic.
• Location: Cloudflare, Inc., USA · global network: pages are served from the data centre nearest the visitor. Logs follow Cloudflare's standard retention.
• Transfer basis: standard contractual clauses, or explicit consent where required.

Planned, not in use yet

No other providers are in use or planned right now. If a new service needs one, we add it here and tell you before it handles any of your data.

Changes to this list

We tell every client before we add or replace a subprocessor. If you object for a good data protection reason, we talk it through and look for another way. You can also end a monthly agreement with 30 days' written notice.

The rules for subprocessors are in our DPA. Questions: [email protected].