Subprocessors
Last updated: 31 July 2026
Mythril-Tech S.R.L. uses the following subprocessors to provide BookMe AI. Each subprocessor is bound by a written data processing agreement meeting GDPR Article 28(3), and international transfers are protected by the EU-U.S. Data Privacy Framework or the 2021 EU Standard Contractual Clauses.
We notify customers at least 10 business days before adding or replacing a subprocessor. Customers may object within 30 days as described in our Data Processing Agreement.
Meta Platforms Ireland Limited (WhatsApp Business Platform)
- Purpose
- Sending and receiving WhatsApp messages between your customers and BookMe AI
- Data accessed
- Message content, phone numbers, WhatsApp Business Account credentials
- Location
- Ireland (global infrastructure)
- Safeguards
- EEA contracting entity; Meta transfer mechanisms (SCCs)
Google LLC — Gemini API
- Purpose
- AI understanding of customer messages and generation of scheduling replies
- Data accessed
- WhatsApp message text
- Location
- United States
- Safeguards
- EU-U.S. Data Privacy Framework; paid API tier — data not used for model training
Google LLC — Calendar API
- Purpose
- Checking availability and creating appointment events in your calendar
- Data accessed
- Customer name, phone number, appointment times
- Location
- United States (global)
- Safeguards
- EU-U.S. Data Privacy Framework
OpenAI, L.L.C.
- Purpose
- Alternative AI provider, only when your account is set to use OpenAI
- Data accessed
- WhatsApp message text (same scope as Gemini)
- Location
- United States
- Safeguards
- EU-U.S. Data Privacy Framework; API data not used for model training
Supabase, Inc.
- Purpose
- Database hosting for conversations, appointments, and account configuration
- Data accessed
- All stored tenant and end-customer data
- Location
- United States (data stored in EU — Dublin, Ireland)
- Safeguards
- EU data residency; EU-U.S. Data Privacy Framework
Vercel, Inc.
- Purpose
- Application hosting and serverless compute
- Data accessed
- Data in transit during webhook/API processing; transient request logs
- Location
- United States
- Safeguards
- EU-U.S. Data Privacy Framework
Twilio Inc.legacy only
- Purpose
- Legacy WhatsApp integration path for tenants connected before the Meta Cloud API migration
- Data accessed
- Message content and phone numbers (legacy tenants only)
- Location
- United States
- Safeguards
- EU-U.S. Data Privacy Framework; not used for new tenants
Billing for your BookMe AI subscription is handled by Revolut. Revolut processes your business's billing data with Mythril-Tech S.R.L. acting as controller and is therefore covered by our Privacy Policy, not this list.
Questions: security@mythril-tech.com