Providers and transfers inventory — Psicobot
Date of the technical verification: 20 October 2026. This inventory describes what the production system actually uses today, according to its configuration. Where no contractual safeguard has been evidenced it says "not evidenced": the existence of agreements, regions, retention periods or measures that have not been checked is not claimed. Controller: Manuel Rafael Elena Navarro, tax ID 30829665M, contacto@psicobot.net.
Providers and function
| Provider | Function | Data processed | Region | Contractual safeguard |
|---|---|---|---|---|
| OpenAI (API) | Chat answers, summaries, SLRC, assisted questionnaires, plans, risk screening and audio transcription when used | Messages, history, case information and audio when transcribed. Names and e-mail are not sent in plan proposals | Not evidenced. May involve processing outside the EEA | DPA and contractual clauses: not evidenced in the repository; pending to be filed |
| Hosting of the platform server and PostgreSQL database (own server contracted from a hosting provider) | Runs the application and stores the data | All platform data | Not evidenced | Hosting contract and role: not evidenced |
| Vercel | Hosting of the public website and interface (psicobot.es) | Web traffic; no psychological content stored | Not evidenced | Not evidenced |
| Resend | Transactional e-mail (account verification, notices, recovery) | E-mail address, name and the notice content | Not evidenced | Not evidenced |
| Google Cloud (voice) | Speech synthesis of answers when the function is on | Text of the answer | Not evidenced | Not evidenced |
| Google Calendar | Professionals' appointment calendar when enabled | Appointment data | Not evidenced | Not evidenced |
| Stripe | Payments for subscriptions or appointments when they exist | Payment and purchase data. There is currently no billing | Not evidenced | Not evidenced |
| WhatsApp (own service over the WhatsApp network) | Redirect only: WhatsApp messages are not sent to the AI or the SLRC | Incoming message and phone number | As set by the messenger | The messenger's terms |
| Backups | Daily local database copy and weekly copy encrypted with age in a private GitHub repository | All platform data | Not evidenced (GitHub) | Not evidenced |
SendGrid is configured in the system but is not the active e-mail provider; Resend is.
International transfers
Some of the providers above may process data outside the European Economic Area. There is currently no evidenced contractual documentation (DPA, standard contractual clauses or applicable adequacy decisions) filed for any of them. Until it is evidenced, no cases of external professionals are onboarded through these routes and no safeguard that is not evidenced is claimed. The data is not used for advertising or training. This inventory will be updated with a new version when each safeguard is evidenced.
Retention actually applied today
- Daily local backups: kept for seven days.
- Weekly encrypted backups on GitHub: kept without automatic expiry; there is no scheduled deletion at 90 days. The 90 days in the Privacy Policy are an objective that the implementation does not guarantee today for these copies.
- Technical server logs: no rotation or automatic deletion is configured; the twelve-month objective in the Privacy Policy is not backed today by an automatic purge.
- Acceptance and withdrawal evidence: kept apart from psychological content, also after account closure, for up to five years.
- AI providers: the technical retention time depends on their configuration and is not evidenced.
Contact for any question about this inventory: contacto@psicobot.net.