Legal
Sub-processors
Last updated: 5 July 2026
In accordance with Art. 28 GDPR, we inform our customers about all third parties (sub-processors) we engage to deliver our services and to whom we may transfer your users' personal data. We contractually ensure that all sub-processors maintain an equivalent level of data protection.
Infrastructure & Hosting
| Provider | Purpose | Location | Data categories | Legal basis | Privacy |
|---|---|---|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting, data storage, compute | EU (Frankfurt, eu-central-1) | All processed customer data | Standard Contractual Clauses (Art. 46 GDPR) | Link |
| Vercel Inc. | Edge hosting & CDN for the web frontend | EU / USA (SCCs) | IP addresses, page views, performance data | Standard Contractual Clauses (Art. 46 GDPR) | Link |
| Cloudflare Inc. | DDoS protection, DNS, TLS termination | EU / USA (SCCs) | IP addresses, HTTP metadata | Standard Contractual Clauses (Art. 46 GDPR) | Link |
| Hetzner Online GmbH | Cloud hosting, server & storage infrastructure | Germany (EU) | All processed customer data | Data Processing Agreement (Art. 28 GDPR) | Link |
Database & Storage
| Provider | Purpose | Location | Data categories | Legal basis | Privacy |
|---|---|---|---|---|---|
| Supabase Inc. | Managed PostgreSQL database service | EU (Frankfurt) | Product and account data, user profile | Data Processing Agreement (Art. 28 GDPR) | Link |
Artificial Intelligence
| Provider | Purpose | Location | Data categories | Legal basis | Privacy |
|---|---|---|---|---|---|
| OpenAI, L.L.C. | AI-powered product data enrichment (copy, attributes) | USA (SCCs) | Product titles, descriptions, attribute values | Standard Contractual Clauses (Art. 46 GDPR) | Link |
| Anthropic PBC | AI-powered product data enrichment (Claude models) | USA (SCCs) | Product titles, descriptions, attribute values | Standard Contractual Clauses (Art. 46 GDPR) | Link |
| Google LLC (Vertex AI) | Alternative AI models for image analysis & translation | EU / USA (SCCs) | Product images, product texts | Standard Contractual Clauses (Art. 46 GDPR) | Link |
| xAI (X.AI LLC) | Alternative AI models (Grok) for product data enrichment | USA (SCCs) | Product titles, descriptions, attribute values | Standard Contractual Clauses (Art. 46 GDPR) | Link |
| Mistral AI SAS | Alternative AI models for product data enrichment | France (EU) | Product titles, descriptions, attribute values | Data Processing Agreement (Art. 28 GDPR) | Link |
| Vercel Inc. (AI Gateway) | Routing of AI requests to open-weight models (incl. DeepSeek, Qwen, GLM) with Zero Data Retention enabled | EU / USA (SCCs) | Product titles, descriptions, attribute values | Standard Contractual Clauses (Art. 46 GDPR) | Link |
| DeepL SE | Automatic translation of product texts | Germany (EU) | Product descriptions, attributes | Data Processing Agreement (Art. 28 GDPR) | Link |
| Exa Labs, Inc. | AI-powered web search & data retrieval for product enrichment | USA (SCCs) | Search queries, product names & identifiers | Standard Contractual Clauses (Art. 46 GDPR) | Link |
Payment Processing
| Provider | Purpose | Location | Data categories | Legal basis | Privacy |
|---|---|---|---|---|---|
| Stripe, Inc. | Credit card and SEPA payment processing | USA / EU (SCCs) | Billing address, payment method metadata | Standard Contractual Clauses (Art. 46 GDPR) | Link |
Email & Communication
| Provider | Purpose | Location | Data categories | Legal basis | Privacy |
|---|---|---|---|---|---|
| Mailgun (Sinch Email) | Email delivery infrastructure & deliverability (SMTP/API) | EU / USA (SCCs) | Email address, name, email content | Standard Contractual Clauses (Art. 46 GDPR) | Link |
Authentication
| Provider | Purpose | Location | Data categories | Legal basis | Privacy |
|---|---|---|---|---|---|
| Google LLC (OAuth) | Social login via Google account | USA (SCCs) | Email address, name, Google user ID | Consent (Art. 6(1)(a) GDPR) | Link |
AI models: no training on your data
For every AI provider we use, we contractually ensure that the product data submitted via the API is not used to train the models:
- •Anthropic (Claude): No training on API data (opt-in only).
- •Google (Gemini / Vertex AI): No training on paid API and Enterprise-tier data.
- •OpenAI (GPT): No training on API data since March 2023 (opt-in only).
- •xAI (Grok): No training on API data; API and enterprise usage are subject to separate data processing terms.
- •Mistral AI: No training on API data; company and hosting located within the EU by default.
- •DeepSeek, Alibaba (Qwen), Z.ai (GLM) and other open-weight models: Served exclusively through the Vercel AI Gateway with Zero Data Retention enabled. Requests are only forwarded to inference providers with a ZDR commitment; no storage beyond request processing and no training on customer data take place.
Change notice
We keep this list up to date whenever our sub-processors change. We notify customers with an active Data Processing Agreement of material changes by email in good time, so you have enough opportunity to review them.
Questions & objections
For questions about our sub-processors or if you wish to object to a change, please contact us at jakob@productbay.ai.