AmeChat is the controller of your personal data. This page lists the third parties we engage to process that data on our behalf ("processors") when you use AmeChat. Each acts only on our documented instructions under a data processing agreement (Art. 28 GDPR). Where a processor in turn relies on its own providers ("sub-processors"), the notable ones are noted in the tables below. A small number of recipients are not processors — the advertising platforms with which we act as joint controllers (Art. 26 GDPR), listed separately below. This page complements Section 6 of our Privacy Policy, which explains how and why we share data.

Where a provider is located outside the EU/EEA, transfers are protected by an adequacy decision (the EU–US Data Privacy Framework, "DPF") where the provider is certified, and/or by the European Commission's Standard Contractual Clauses ("SCCs").

Infrastructure and platform

Provider	Function	Location	Transfer mechanism
Hetzner Online GmbH — Industriestr. 25, 91710 Gunzenhausen, Germany	Cloud hosting, servers, databases, backups	Nuremberg & Falkenstein (DE), Helsinki (FI) — EU/EEA	None required (EU)
Cloudflare, Inc. — 101 Townsend Street, San Francisco, CA 94107, USA	Media storage (R2), backups, content delivery, network/ingress, security	R2 buckets configured with EU jurisdiction (media stored in the EU); global network for delivery/security	DPF (certified) + SCCs

AI inference providers

Content is sent to an AI provider only when you invoke the AI (see Privacy Policy Section 5.1). By contract, these providers do not train on your content and do not disclose it; inputs/outputs may be retained for up to 30 days for abuse monitoring, then deleted.

Provider	Function	Location	Transfer mechanism
Anthropic, PBC — 548 Market Street, PMB 90375, San Francisco, CA 94104, USA	AI model inference (Claude)	USA	SCCs
OpenAI OpCo, LLC — 1455 3rd Street, San Francisco, CA 94158, USA	AI model inference (GPT), voice transcription, memory embeddings	USA	SCCs
Google Cloud EMEA Limited — Velasco, Clanwilliam Place, Dublin 2, Ireland (sub-processor: Google LLC, USA)	AI model inference (Gemini), where used	Ireland (EU); processing in US/EU regions via Google LLC	DPF (Google LLC certified) + SCCs

Communications and delivery

Provider	Function	Location	Transfer mechanism
Plus Five Five, Inc. (Resend) — 2261 Market Street #5039, San Francisco, CA 94114, USA	Transactional email (account verification, password reset, delivery notices)	USA	DPF (certified) + SCCs
Google Cloud EMEA Limited — Velasco, Clanwilliam Place, Dublin 2, Ireland (sub-processor: Google LLC, USA)	Push notifications (Firebase Cloud Messaging)	Ireland (EU); US via Google LLC	DPF (Google LLC certified) + SCCs
Apple Inc. — One Apple Park Way, Cupertino, CA 95014, USA	Push notifications on Apple devices (Apple Push Notification service; encrypted, content-free payloads)	USA	DPF (certified) + SCCs
Google Cloud EMEA Limited — Velasco, Clanwilliam Place, Dublin 2, Ireland (sub-processor: Google LLC, USA)	Business email and our support/legal mailbox (Google Workspace)	Ireland (EU); US via Google LLC	DPF (Google LLC certified) + SCCs

Push payloads are minimised. Resend relies on Amazon Web Services (AWS) as its own sub-processor for email delivery infrastructure.

Payments

Provider	Function	Location	Transfer mechanism
Stripe Payments Europe, Ltd. — 1 Grand Canal Street Lower, Dublin, Ireland (affiliate: Stripe, Inc., USA)	Payment processing for subscriptions and credit packs purchased on our website	Ireland (EU); US via Stripe, Inc.	DPF (Stripe, Inc. certified) + SCCs
Apple Distribution International Ltd. — Hollyhill Industrial Estate, Hollyhill, Cork, Ireland (affiliate: Apple Inc., USA)	Purchases made inside our iOS app. Apple is the merchant of record: it takes payment, issues receipts, and handles refunds and billing enquiries under its own privacy policy	Ireland (EU); US within the Apple group	DPF (Apple Inc. certified) + SCCs

Payment providers act as independent controllers for executing the payment and for fraud prevention, under their own privacy policies. Your card details never reach us: we receive only the transaction and subscription status we need to activate your plan.

Diagnostics and crash reporting

When our apps crash or hit a serious error, they send us a technical report so we can find and fix the fault. Reports are minimised before they leave your device and are not intended to carry the content of your conversations (see Privacy Policy Section 2.4).

Provider	Function	Location	Transfer mechanism
Functional Software, Inc. d/b/a Sentry — 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA	Crash and error reporting for our apps: stack traces, app version and build, device model, operating system version, and the technical events preceding a failure	Report data is stored in Sentry's EU region (Frankfurt, Germany); our own account and organisation metadata are held in the USA	DPF (certified) + SCCs

Website analytics and advertising

These providers process data from our website to measure traffic and, where you consent, to measure and improve our advertising. Analytics and marketing cookies run only with your consent (see Privacy Policy Section 9.2). Cloudflare Web Analytics is cookieless and runs on our legitimate interest, without setting cookies or identifiers on your device.

Processors

Provider	Function	Location	Transfer mechanism
Google Ireland Limited — Gordon House, Barrow Street, Dublin 4, Ireland (sub-processor: Google LLC, USA)	Website analytics (Google Analytics 4), subject to consent	Ireland (EU); US via Google LLC	DPF (Google LLC certified) + SCCs
Cloudflare, Inc. — 101 Townsend Street, San Francisco, CA 94107, USA	Cookieless website analytics (Cloudflare Web Analytics) — aggregate traffic and page performance	Global network	DPF (certified) + SCCs

Joint controllers

For advertising measurement and retargeting, these platforms determine the purposes of that specific processing together with us, so we act as joint controllers under Art. 26 GDPR rather than as controller and processor. This runs only with your consent and never involves the content of your conversations.

Provider	Function	Location	Transfer mechanism
Google Ireland Limited — Gordon House, Barrow Street, Dublin 4, Ireland (sub-processor: Google LLC, USA)	Advertising measurement and conversion tracking (Google Ads), subject to consent	Ireland (EU); US via Google LLC	DPF (Google LLC certified) + SCCs
Meta Platforms Ireland Limited — 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (sub-processor: Meta Platforms, Inc., USA)	Advertising measurement and retargeting (Meta Pixel), subject to consent	Ireland (EU); US via Meta Platforms, Inc.	DPF (Meta certified) + SCCs

Changes to this list

We keep this page current. Before we add or replace a sub-processor that processes your personal data, we update this list; where required, we give advance notice and you may object on legitimate grounds. For questions about our sub-processors, contact [email protected].