Holina

Subprocessors

Last updated: August 1, 2026 · Referenced by the Privacy Policy and the Data Processing Addendum

To run the Holina service, EpochCore LLC uses a small number of third-party providers that may process personal data on our behalf. This page lists all of them, what each one does, and what data it sees. Every provider here is bound by a written agreement limiting them to processing data only on our instructions.

Speech and language processing runs on hardware we own. The speech-to-text, the voice your callers hear, and the language model that answers them run on EpochCore's own GPUs, not on a third-party AI provider. Call audio and transcripts are not sent to an external AI vendor for processing, and are never used to train anyone else's model. That is a deliberate design choice and it is why this list is shorter than most.

Core infrastructure — used for every customer

ProviderWhat it does for usData it processesLocation
Cloudflare, Inc. Hosting, edge network, application databases (D1), key-value and object storage, bot protection (Turnstile), and the text-chat language model on the website Everything the service stores: business configuration, call and booking records, leads, consent records, website traffic United States / global edge
Twilio Inc. Phone numbers, inbound and outbound calling, SMS delivery, and carrier registration (10DLC / toll-free verification) Caller and recipient phone numbers, call metadata, call audio in transit, message content United States
Stripe, Inc. Subscription billing and payment processing Business billing contact, payment card data (held by Stripe — never by us), invoices and subscription state United States
Resend (Plus Five Five, Inc.) Transactional email: booking confirmations and reminders, lead notifications, billing notices Recipient email address, name, and the message content United States

Used only for specific features

ProviderWhen it is usedData it processesLocation
Google LLC Calendar availability and appointment creation, for customers who use booking. Also our own business email. Appointment times, attendee name and contact details for booked appointments United States
Twilio SendGrid Backup transactional email path when the primary provider is unavailable Recipient email address and message content United States
OpenPhone Technologies, Inc. Operational notifications to our own team and to business owners (escalation alerts, daily recaps) Business owner phone number and the notification text United States
ElevenLabs Inc. Legacy voice runtime only. Used only for a customer explicitly configured on the ElevenLabs voice path; new customers use our self-hosted voice stack. Call audio and transcript text for those customers only United States
bookingto.me Reading and writing appointments for customers whose existing appointment book is bookingto.me Appointment times and attendee details for that customer only Operator-designated
Sent.dm Alternative messaging channel. Currently not active for any customer; listed for transparency because the integration exists. Recipient phone number and message content, if enabled United States

Not used

To be explicit, because customers ask: we do not send call audio, transcripts, or business data to OpenAI, Anthropic, Google Gemini, Amazon, or any other third-party AI provider for processing. We do not use advertising or marketing analytics platforms, and we do not use third-party cookies — see the Cookie Notice.

Changes to this list

Before we add a new subprocessor that will process customer personal data, we update this page. Customers with a signed Data Processing Addendum receive at least 30 days' advance notice by email to their account contact and may object on reasonable data-protection grounds, as described in that addendum.

To be notified of changes, email john@holina.io and ask to be added to the subprocessor notice list.

Contact