Casola Subprocessors
Last updated: August 2, 2026
Effective date: August 2, 2026
These are the third parties that process personal data on our behalf. Each is bound by contract to act only on our instructions, to protect the data at least as well as we do, and to help us meet our own obligations. This list used to live only inside our Data Processing Addendum, which meant the people most affected by it never saw it; it is published here for that reason.
Current subprocessors
| Provider | What it does | Data it sees | Where |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, edge network, application runtime, database, object storage, bot protection, and outbound service email. Nearly all of the Service runs here. | Everything the Service processes, including session recordings, transcripts, account data, and request logs. | United States, with edge processing worldwide |
| GPU compute provider | Rented infrastructure on which Casola runs its own avatar, voice, and speech models. No third-party model provider receives your data. | Session audio and video in flight, and the avatar configuration for the session. | United States |
| Hetzner Online GmbH | Rented servers running our self-hosted observability system, which receives application and session logs. | Session identifiers, workspace identifiers, timestamps, transcripts and diagnostic log lines. Not recordings. | Germany |
| Stripe, Inc. | Subscription payments: hosted checkout, the customer billing portal, invoices, renewals, and tax. | The name and email address on the account that subscribes, our internal workspace identifier, and the plan and payment status that come back to us. Card details, billing address, and anything else you type on Stripe’s own pages go from your browser to Stripe; we never receive or store them. | United States |
| Google LLC | Google Analytics 4. Also Google Sign-In, if you choose it. | Analytics identifiers and page events; your Casola user identifier when you are signed in to the dashboard. For sign-in: the profile Google returns to us. | United States |
| GitHub, Inc. (Microsoft) | GitHub sign-in, if you choose it. | The profile and verified email GitHub returns to us. | United States |
Sign-in providers
Google and GitHub appear above because they process data for us when you choose to sign in with them. They are also independent controllers of your relationship with them, and what they do with your account on their own behalf is governed by their privacy policies, not ours.
Changes to this list
We give API customers with an executed Data Processing Addendum at least 30 days’ notice before we add or replace a subprocessor, during which they may object on reasonable data-protection grounds. To receive those notices, email privacy@casola.ai and ask to be added to the list.
For consumer users, this page is the notice. The “last updated” date at the top changes whenever the table does.