Subprocessors
Last modified: June 10, 2026
ChatBotKit engages the following third-party subprocessors to deliver its services. All subprocessors are bound by data processing agreements that require them to protect personal data in accordance with applicable data protection laws, including GDPR.
This list is maintained in accordance with our Data Processing Addendum (Exhibit 2). This page is updated at least 30 days before any new subprocessor is added, and customers subscribed to subprocessor notifications are also notified by email. Customers have the right to object as described in the DPA.
For questions about subprocessors, contact our Privacy Contact at .
Current Subprocessors
| Name | Category | Country | Data Types Processed | Region of Processing |
|---|---|---|---|---|
| Hetzner | Infrastructure – Private Cloud | Germany | All platform data including conversations, user data, stored files | European Union (EU) |
| PlanetScale | Database – Core | United States | All structured platform data: user accounts, bots, datasets, conversations, messages | United States |
| Vercel | Application Hosting, API & AI Models | United States | Request/response data, application logs, session data, conversation messages and context submitted to AI models via AI Gateway | United States |
| Amazon Web Services | Data Hosting, AI Models & Services | United States | Stored files, AI model inference inputs/outputs, PII scanning (AWS Comprehend), email delivery (SES) | United States |
| Cloudflare | AI Models | United States | Conversation messages and context submitted to AI models | United States |
| Google Cloud | AI Models | United States | Conversation messages and context submitted to AI models | United States |
| OpenAI | AI Models | United States | Conversation messages and context submitted to AI models | United States |
| Pinecone | AI Models | United States | Dataset content and conversation data submitted to AI models | United States |
| Upstash | Data Hosting – Cache & Queue | United States | Ephemeral session data, job queue payloads, rate-limiting counters | United States |
| Stripe, Inc. | Payment Processing | United States | Billing information, subscription data, payment method metadata | United States |
| Zendesk, Inc. | Customer Support | United States | Support ticket content, user contact information shared in support interactions | United States |
| Twilio SendGrid | Transactional Email | United States | Email addresses, email content for transactional notifications and account communications | United States |
ChatBotKit also offers optional integrations with additional third-party AI providers (such as DeepSeek, Groq, Mistral, Perplexity, and OpenRouter). These integrations operate using credentials the customer supplies and configures; in that case the provider is engaged directly by the customer and does not act as a ChatBotKit subprocessor.
AI model requests routed through an AI gateway (such as the Vercel AI Gateway or the Cloudflare AI Gateway) are fulfilled by the underlying model providers acting as subprocessors of the respective gateway provider, with zero data retention enforced for all platform-managed traffic.
Data Transfer Mechanisms
All transfers of personal data from the European Economic Area (EEA) or the United Kingdom to subprocessors located in the United States are carried out under the EU Standard Contractual Clauses (2021) and, where applicable, the UK International Data Transfer Addendum, as described in Sections 4(b)–4(c) of our Data Processing Addendum.
Change Log
ChatBotKit maintains a record of subprocessor changes. Customers subscribed to DPA notifications will receive advance notice of any additions or material changes. If you are a customer and would like to be added to the subprocessor notification list, contact .
| Date | Change |
|---|---|
| 2026-06-10 | Added Cloudflare (AI Models); recategorized Pinecone as AI Models and AWS as Data Hosting, AI Models & Services; expanded Vercel purpose to include AI Models (AI Gateway) |
| 2026-06-09 | Added Google Cloud (AI Models); removed OpenRouter; recategorized OpenAI as AI Models and Pinecone as AI Services |
| 2025-01-01 | Initial published list |