Subprocessors and International Transfers

Table of contents#

1. How to read this page
2. Hosting and locations
3. Subprocessor list
4. Subprocessors by product
5. Customer-selected AI providers (bring your own key)
6. Transfer mechanism per subprocessor
7. Independent controllers (not subprocessors)
8. Changes and how to subscribe
9. International transfers (Brazil — Res. CD/ANPD 19/2024)

1. How to read this page#

1.1 Two roles. SonhoLab (L. M. PEREZ MONTANA, CNPJ 61.620.014/0001-00) uses these companies in two roles:

• as processor for business customers, for data they load into a System. The Data Processing Addendum (DPA) governs this role. For that data, this page is Annex III of the DPA.
• as controller for its own website, accounts, billing, support and consumer apps. The Privacy Policy governs this role.

1.2 What "subprocessor" means here. A subprocessor is a company that processes customer or user personal data on SonhoLab's behalf. Services SonhoLab runs itself on its hosting (for example, its own email server) are not listed as separate subprocessors.

1.3 Complete list. SonhoLab does not use its own AI accounts to process Customer Data. AI providers that a customer connects with its own key are the customer's vendors (Section 5). SonhoLab's own AI account is used only for SonhoLab's own activities as controller (Section 3.1).

2. Hosting and locations#

2.1 Primary hosting. Hetzner Online GmbH (Germany) hosts the Systems on servers in Helsinki, Finland (EU).

2.2 Backups. Hetzner makes automated server backups in Finland. Database backups on the server side are kept up to 14 days. An off-site copy is encrypted before it leaves the server and is stored for up to 14 days on equipment operated by SonhoLab in Brazil. Brazil and the EU recognize each other as adequate (Section 6). Deleted data disappears from backups when the backups expire, within 30 days at most.

2.3 Email. SonhoLab runs its own email server (mailcow) on the same Hetzner infrastructure.

2.4 Remote access. SonhoLab personnel work from Brazil and may access data remotely for support and operations.

2.5 Equipment in Brazil. Apart from the encrypted backup copy in Section 2.2, no business System is processed on equipment operated by SonhoLab in Brazil. Hades, which is not currently offered to the public, has its own locations and providers, described only in the Hades Addendum: Voice, Biometrics, Memorials and Companion AI.

3. Subprocessor list#

No SonhoLab AI account for Customer Data. No AI provider is a SonhoLab subprocessor for Customer Data. Every AI feature of every System runs on the customer's own AI provider account and key (Section 5). SonhoLab itself does not train models on Customer Data. It does not sell personal data, and it does not share personal data for cross-context behavioral advertising.

3.1 Providers for SonhoLab's own activities (SonhoLab as controller)#

Hades is not currently offered to the public. The providers and equipment it uses are listed in the Hades Addendum: Voice, Biometrics, Memorials and Companion AI, section 14.

4. Subprocessors by product#

"AI features" means features a System offers that use a language, speech or vision model. In every System they are available only on paid plans and run only on the customer's own AI key (Section 5). They stay off until the customer adds a key.

We update this list before a new AI feature goes live in any System.

5. Customer-selected AI providers (bring your own key)#

5.1 All Systems. Every AI feature in every SonhoLab System and agent product runs on the customer's own AI provider account. This includes Inventory, Verita, Clinics, Farm, Real Estate CRM, Bidstream, Brain SaaS, the LLM gateway, Jesse and Digital Team OS. The Job Portal has no AI features. SonhoLab's own AI accounts are never used for customers.

5.2 Paid plans only; the customer chooses and contracts. The Free plan of every System has no AI features. AI features exist only on paid plans (Basic and Premium, or the product's own paid plan). The customer chooses the AI provider and model (usually OpenAI), contracts with that provider directly and enters its own API key in the System's settings. SonhoLab never supplies an AI key to any customer. The AI features of a System stay off until the customer adds a key.

5.3 Not a SonhoLab subprocessor. That AI provider is the customer's own vendor, under the customer's own contract. SonhoLab transmits to it only the data that the customer's configuration sends, because the customer instructs it to by adding the key. SonhoLab does not list that provider as its subprocessor, and SonhoLab's 30-day change notice does not apply to it.

5.4 Customer responsibilities. The customer is responsible for:

• (a) that provider's terms and usage policies, its data processing agreement and its international-transfer safeguards;
• (b) choosing a provider, plan and settings that do not allow training on the data;
• (c) paying that provider for usage. The provider bills the customer directly. SonhoLab is not responsible for the provider's charges, availability, outages, outputs or policy changes; and
• (d) telling its own customers, patients, students or users which AI provider it uses, where the law requires it.

5.5 What SonhoLab does. SonhoLab stores the key outside source code, with access restricted to SonhoLab personnel, uses it only for that customer's own features, sends only what the feature needs, and deletes the key when the customer asks or removes it. Everything else stays under the DPA. The AI Agents and Messaging Addendum and the AI Transparency Notice explain the features.

6. Transfer mechanism per subprocessor#

Terms used:

• EU adequacy (Brazil): Commission Implementing Decision (EU) 2026/179 for the EEA to Brazil. Res. CD/ANPD 32/2026 for Brazil to the EU.
• EU SCCs: the standard contractual clauses of Decision (EU) 2021/914. Module 2 applies where SonhoLab is controller. Module 3 applies where SonhoLab is processor.
• DPF: the EU-US Data Privacy Framework (Decision (EU) 2023/1795) and its UK extension. We rely on it only where the company is certified, and always together with the SCCs.
• UK Addendum / IDTA: the UK transfer tools issued by the Information Commissioner.
• ANPD Clauses: the standard contractual clauses of Res. CD/ANPD 19/2024, Annex II, used in full and without changes.

For an AI provider that the customer connects with its own key (Section 5), the customer puts the transfer safeguards in place under its own contract with that provider.

Transfers from the EEA to SonhoLab in Brazil, including the encrypted off-site backup copy (Section 2.2), rely on EU adequacy. Transfers from the UK to SonhoLab in Brazil rely on the UK Addendum, because the UK has not recognized Brazil as adequate. The DPA, Annex IV, sets out the full terms.

Copies. You can ask for a copy of the transfer clauses at contacto@sonholab.com. We send the full text within 15 days. We may remove commercial terms that are not relevant.

7. Independent controllers (not subprocessors)#

These companies receive personal data when you use them, but they decide on their own how to process it. Their own privacy policies apply.

8. Changes and how to subscribe#

8.1 Notice period. SonhoLab gives business customers at least 30 days' notice before it adds or replaces a subprocessor that processes Customer Personal Data. It does this by:

• (a) updating this page, with the date and a description of each change in the change log below; and
• (b) emailing the account owner email of each affected organization, and every person subscribed to change notices.

8.2 Subscribe. Anyone can subscribe to change notices. Write to contacto@sonholab.com with the subject "Subprocessor updates". You can unsubscribe at any time the same way.

8.3 Objections. Business customers can object within the 30 days, as described in the DPA, Section 8.

8.4 Emergency changes. If a subprocessor must be replaced urgently for security or continuity reasons, we give notice as soon as possible. The objection right still applies.

8.5 Change log.

9. International transfers (Brazil — Res. CD/ANPD 19/2024)#

9.1 Who we are. L. M. PEREZ MONTANA (SonhoLab), CNPJ 61.620.014/0001-00, Rua Fausto Cabral, 871, Casa A, Vicente Pinzon, Fortaleza-CE, 60181-227, Brazil. Encarregado (DPO): contacto@sonholab.com. The supervisory authority is the Agência Nacional de Proteção de Dados (ANPD).

9.2 Where your data goes.

The encrypted off-site backup copy is kept on equipment operated by SonhoLab in Brazil. Keeping it in Brazil is not an international transfer. AI providers that a customer connects with its own key are the customer's vendors; the customer arranges the transfer safeguards with them (Section 5).

9.3 What data. It depends on the product and the features you use. Section 4 of this page shows which companies each product uses. The Data Processing Addendum (DPA), Annex I, describes the data per System.

9.4 Clauses used without changes. When we use the ANPD standard contractual clauses, we use them in full and without changes (Res. CD/ANPD 19/2024, Art. 16).

9.5 Copy of the clauses. You can ask for the full text of the clauses we use at contacto@sonholab.com. We send it within 15 days.

9.6 Your rights. You can exercise your LGPD rights, including information about sharing and international transfers (LGPD Art. 18), as explained in Your Privacy Rights and How to Exercise Them. You can also complain to the ANPD.

9.7 Customer data. Where SonhoLab acts as operator for a school, clinic or company, that organization is the controller. Contact it first. We help it answer.

Version 0.9.0 (preliminary) · Effective 26 September 2026 · © L. M. PEREZ MONTANA (SonhoLab), CNPJ 61.620.014/0001-00. This version is under legal review; we will notify material changes as described in these documents.