Legal

Legal Documents

truffalo GmbH · Vienna, Austria · All documents in German (PDF)

Datenschutzerklärung — Privacy Policy
Auftragsverarbeitungsvertrag — Data Processing Agreement (Art. 28 GDPR)
Kooperationsvereinbarung & AGB — Cooperation Agreement for the use of truffalo.ai

Sub-processors

Third-party processors of the truffalo SaaS platform · Last reviewed: 22 July 2026

This list shows the third-party service providers (sub-processors) that the truffalo SaaS platform may engage to process customer data, what each one handles, where it is located, and links to its privacy policy and — where available — its Data Processing Agreement (DPA). This is an operational reference; it does not itself constitute a DPA. For the contractual DPA governing your use of truffalo, contact hello@truffalo.ai.

1. Anthropic · OpenAI · Google (LLMs)USEU models routes

Handles	Ingested content sent to large language models via the Vercel AI Gateway — parsing, cards, deals, chat, enrichment.
Location	United States, with EU-routed models available.
Notes	Zero-retention is required; Data Privacy Framework status to be confirmed per provider (with counsel).
Anthropic	Privacy policy · Commercial terms · Trust Center
OpenAI	Privacy policy · DPA · Enterprise privacy
Google (Gemini / Vertex AI)	Privacy policy · Cloud DPA · Gemini API terms

2. VercelUS / edgeEU region

Handles	Hosting, serverless functions and edge — all application data in transit; also operates the AI Gateway.
Location	United States / edge network, with EU function regions available.
Policies	Privacy policy · DPA · Sub-processors

3. Neon (Postgres)EU region

Handles	All personally identifiable information — clients, contacts, users, sources.
Location	EU region available.
Policies	Privacy notice · DPA (PDF) · Sub-processors

⚠ Neon has been acquired by Databricks. Its privacy policy now redirects to the Databricks privacy notice; treat Databricks as the controlling entity.

4. Cloudflare R2 & WorkersEU region

Handles	Parsed content blobs (markdown), logos, avatars; and the EU PDF-render Worker.
Location	EU-jurisdiction buckets
Policies	Privacy policy · DPA

5. NylasEU region

Handles	Email content (read) and the platform's outbound mail.
Location	EU region
Policies	Privacy policy · Security / Trust

No self-serve public DPA — Nylas issues its DPA on request (embedded in the MSA).

6. Google (Chat / Drive)EU region

Handles	Google Chat and Google Drive content.
Location	United States.
Notes	Google also appears as an LLM provider (row 1) and as OAuth sign-in.
Policies	Privacy policy · Workspace / Cloud DPA · API user-data policy

7. TelegramDistributed

Handles	Inbound messages and voice notes.
Location	Distributed.
Notes	Per-org bot; transfer mechanism still to be determined.
Policies	Privacy policy · Bot developer ToS · Standard bot privacy

Telegram offers no DPA and no GDPR processor terms.

Effective dates of the linked policies vary by provider and change over time. Links were last verified on 22 July 2026. This list is maintained for transparency and does not replace the contractual Data Processing Agreement between you and truffalo.