Legal
Sub-processors
Running Grammateas takes servers, telephone lines and voice and language models. Here, by name, is who does what, where they are and what they see.
Last updated: 12 September 2026 · This English version is provided for convenience; in case of divergence the Greek text prevails.
All of them are bound by a contract under Article 28 GDPR, process data only on our instructions, and are not permitted to use it for their own purposes or to train models.
Infrastructure — inside the EU
| Provider | What it does | What it sees | Where |
|---|---|---|---|
| Hetzner Online GmbH | Hosting of the application, the database, the recordings and the telephony server | All the data, encrypted in transit; it has no reason to access the content | Germany (EU) |
| Cloudflare, Inc. | DNS and protection of the website (CDN, filtering of malicious traffic) | Website traffic data (IP address, page requests). No calls or recordings pass through it | Global network; SCCs, with the main processing in the EU |
Telephony and SMS — Greece
| Provider | What it does | What it sees | Where |
|---|---|---|---|
| Yuboto S.A. | Telephone lines (SIP), numbers, sending SMS | Calling numbers, time and duration, the audio while it is carried, the text of the SMS | Greece (EU) |
| net2voip (voip77) | Alternative telecoms provider and numbers | Calling numbers, time and duration, the audio while it is carried | Greece (EU) |
If the customer keeps their own phone system or provider, the line is handled by their provider and not by the above.
Voice and language models
Depending on each account's configuration, one of the following is used for each task. Only what is needed for the answer of the moment is sent — not the whole customer database.
| Provider | What it does | What it sees | Where / safeguard |
|---|---|---|---|
| Anthropic PBC | The language model that composes the answer (default) | The text of the conversation and the account's instructions | USA · SCCs · not used for training |
| ElevenLabs Inc. | Speech recognition and the Greek voice | The audio of the call and its transcript | USA/EU · SCCs · not used for training |
| Deepgram Inc. | Alternative speech recognition | The audio of the call | USA · SCCs · not used for training |
| OpenAI, L.L.C. | Alternative language model, speech recognition and speech synthesis | The text or the audio of the conversation | USA · SCCs · not used for training (API) |
| Google Ireland Ltd. (Gemini) | Alternative language model and speech synthesis | The text of the conversation | EU/USA · SCCs · not used for training (API) |
For customers who ask, we can restrict the configuration to providers that process inside the EU. Ask us before activation.
Notifications and communication
| Provider | What it does | What it sees | Where / safeguard |
|---|---|---|---|
| Resend, Inc. | Sending e-mail: message notifications, appointment confirmations, requests from the site | The recipient's address and the content of the message | USA · SCCs |
| Google Ireland Ltd. / Microsoft Ireland | Connection to the customer's calendar, contacts and mailbox, when they switch it on | Whatever the customer themselves permits when connecting | EU · the customer remains the controller |
Changes to this list
Before we add or replace a sub-processor, we notify customers at least 30 days in advance by e-mail. If a customer has a reasoned objection on data protection grounds, they may raise it and, if no solution is found, terminate the agreement at no cost.
For questions, or to receive the change notifications: i.kotrotsios@rm.gr. See also the Data Processing Agreement and the Privacy Policy.
SCCs = the European Commission's Standard Contractual Clauses (Article 46(2)(c) GDPR).