←back to legal documents

Subprocessors

A complete list of third-party subprocessors used by ChatBotKit to deliver its services, including the category of processing, data types handled, and the country where data is processed.

ChatBotKit engages the following third-party subprocessors to deliver its services. All subprocessors are bound by data processing agreements that require them to protect personal data in accordance with applicable data protection laws, including GDPR.

This list is maintained in accordance with our Data Processing Addendum (Exhibit 2). Customers will be notified by email at least 30 days before any new subprocessor is added, and have the right to object as described in the DPA.

For questions about subprocessors, contact our Data Protection Officer at .

Current Subprocessors

NameCategoryCountryData Types ProcessedRegion of Processing
HetznerInfrastructure – Private CloudGermanyAll platform data including conversations, user data, stored filesEuropean Union (EU)
PlanetScaleDatabase – CoreUnited StatesAll structured platform data: user accounts, bots, datasets, conversations, messagesUnited States
VercelApplication Hosting & APIUnited StatesRequest/response data, application logs, session dataUnited States
Amazon Web ServicesData Hosting & AI ServicesUnited StatesStored files, AI model inference inputs/outputs, PII scanning (AWS Comprehend), email delivery (SES)United States
OpenAIAI ServicesUnited StatesConversation messages and context submitted to AI modelsUnited States
OpenRouterAI Services – Model RoutingUnited StatesConversation messages and context submitted to AI models via routing layerUnited States
PineconeVector DatabaseUnited StatesEmbeddings derived from dataset content and conversation dataUnited States
UpstashData Hosting – Cache & QueueUnited StatesEphemeral session data, job queue payloads, rate-limiting countersUnited States
Stripe, Inc.Payment ProcessingUnited StatesBilling information, subscription data, payment method metadataUnited States
Zendesk, Inc.Customer SupportUnited StatesSupport ticket content, user contact information shared in support interactionsUnited States
Twilio SendGridTransactional EmailUnited StatesEmail addresses, email content for transactional notifications and account communicationsUnited States

Data Transfer Mechanisms

All transfers of personal data from the European Economic Area (EEA) or the United Kingdom to subprocessors located in the United States are carried out under the EU Standard Contractual Clauses (2021) and, where applicable, the UK International Data Transfer Addendum, as described in Sections 4(b)–4(c) of our Data Processing Addendum.

Change Log

ChatBotKit maintains a record of subprocessor changes. Customers subscribed to DPA notifications will receive advance notice of any additions or material changes. If you are a customer and would like to be added to the subprocessor notification list, contact .

DateChange
2025-01-01Initial published list