Last Updated: Oct 19, 2026
This Data Processing Agreement (“DPA”) forms part of the written agreement between Peec AI US Inc. or Peec AI GmbH (hereafter the “Company”) and the customer entity (hereafter the “Customer”) that is party to the Master Customer Agreement or End User License Agreement (the “Agreement”). This DPA prevails over any conflicting term of the Agreement but does not otherwise modify the Agreement.
1. Definitions
1.1. In this DPA:
a) “Controller”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Processing”, and “Supervisory Authority” have the meaning given to them in Data Protection Law. “Data Subject” includes “Consumer” as that term is defined under U.S. Privacy Laws;
b) “Customer Personal Data” means Personal Data Processed by Company as a Processor on behalf of Customer or Third-Party Controller;
c) “EU-US Data Privacy Framework” means the adequacy decision laid down in the Commission Implementing Decision EU 2023/1795 of July 10, 2023, on the adequate level of protection of personal data under the EU-US Data Privacy Framework, and includes UK Extension to the EU-US Data Privacy Framework as defined in Data Protection (Adequacy) (United States of America) Regulations 2023/1028;
d) “Data Protection Law” means U.S. Privacy Laws, the General Data Protection Regulation (EU) 2016/679 (“EU GDPR”), the UK GDPR as defined by section 205(4) of the UK Data Protection Act 2018 (“UK GDPR”), the UK Data Protection Act 2018, the e-Privacy Directive 2002/58/EC (as amended by Directive 2009/136/EC) (“ePD”), the Privacy and Electronic Communications Regulations 2003, and national implementations of the EU GDPR and ePD in the European Economic Area (“EEA”), including the European Union, and all other data protection laws of the EEA, the United Kingdom (“UK”), and Switzerland, each as applicable, and as may be amended or replaced from time to time;
e) “Data Subject Rights” means Data Subjects’ rights to information, access, rectification, erasure, restriction, portability, objection, the right to withdraw consent, and the right not to be subject to automated individual decision-making in accordance with Data Protection Law;
f) “International Data Transfer” means any disclosure of Customer Personal Data by an organization subject to Data Protection Law to another organization located outside the EEA, the UK, or Switzerland;
g) “Processor” means “Processor,” “Service Provider,” or “Contractor” as those terms are defined in Data Protection Law.
h) “Sale” and “Selling” have the meaning defined in the U.S. Privacy Laws.
i) “Services” means the services provided by Company to Customer under the Agreement;
j) “Share,” “Shared,” and “Sharing” have the meaning defined in the CCPA;
k) “Special Categories of Personal Data” shall have the meaning assigned to that term in the EU GDPR and the UK GDPR, and shall include data relating to criminal convictions and offenses;
l) “Subprocessor” means a Processor engaged by Company to Process Customer Personal Data;
m) “SCCs” means the clauses annexed to the EU Commission Implementing Decision 2021/914 of June 4, 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council as amended or replaced from time to time;
n) “Third-Party Controller” means a Controller for which Customer is a Processor; and
o) “U.S. Privacy Laws” means, collectively, all United States federal and state privacy laws and their implementing regulations, as amended or superseded from time to time, that apply generally to the processing of individuals’ Personal Data and that do not apply solely to specific industry sectors (e.g., financial institutions), specific demographics (e.g., children), or specific classes of information (e.g., health or biometric information). U.S. Privacy Laws include, but are not limited to the following:
the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (“CCPA”);
Colorado Privacy Act;
Connecticut Personal Data Privacy and Online Monitoring Act;
Delaware Personal Data Privacy Act;
Indiana Consumer Data Protection Act;
Iowa Consumer Data Protection Act;
Kentucky Consumer Data Protection Act;
Maryland Online Data Privacy Act;
Minnesota Consumer Data Privacy Act;
Montana Consumer Data Privacy Act;
Nebraska Data Privacy Act;
Nevada Consumer Health Privacy Act (NV SB 370);
New Hampshire Act Relative to the Expectation of Privacy;
New Jersey Act Concerning Online Services, Consumers, and Personal Data;
Oregon Consumer Privacy Act;
Rhode Island Data Transparency and Privacy Protection Act;
Tennessee Information Privacy Act;
Texas Data Privacy and Security Act;
Utah Consumer Privacy Act;
Virginia Consumer Data Protection Act; and
Washington My Health My Data Act.
1.2. Capitalized terms used but not defined herein have the meaning given to them in the Agreement.
1.3. In the event of a conflict in the meanings of defined terms in Data Protection Law, the meaning from the Data Protection Law applicable to the relevant jurisdiction of the Data Subject applies.
2. Scope
2.1. This DPA applies to the Processing of Customer Personal Data by Company subject to Data Protection Law to provide the Services.
2.2. The subject matter, nature and purpose of the Processing, the types of Customer Personal Data and categories of Data Subjects are set out in Annex I, which is an integral part of this DPA.
2.3. Customer is a Controller and appoints Company as a Processor on behalf of Customer. Customer is responsible for compliance with the requirements of Data Protection Law applicable to Controllers.
2.4. If Customer is a Processor on behalf of a Third-Party Controller, then Customer: is the single point of contact for Company; must obtain all necessary authorizations from such Third-Party Controller; and undertakes to issue all instructions and exercise all rights on behalf of such other Third-Party Controller.
2.5. Company Processes the following Personal Data as an independent Controller and not on behalf of Customer: (a) Personal Data relating to the operation, support, or use of the Services that Company Processes for its own business purposes, such as account management, authentication, billing and technical support, and tracking usage, telemetry, and security indicators; (b) responses of the AI models queried through the Services, content retrieved from publicly accessible sources, and data derived from them, to the extent Company retains and uses them for its own purposes, such as maintaining its entity register, cross-customer analyses, and developing and training its models; and (c) Personal Data contained in Customer Data, to the extent Company uses it, as permitted under the Agreement, to evaluate, develop and train the models it uses to provide the Services. This applies even where the same data is also stored in Customer’s workspace and Processed there as Customer Personal Data. Such Processing is described in Company’s privacy policy and is not governed by this DPA; in particular, Sections 3.1 and 3.4 do not apply to it. Section 10.2 nevertheless applies to Personal Data under (c), unless it has been de-identified.
2.6. The Parties acknowledge and agree that the disclosure or making available of Customer Personal Data between the Parties does not form part of any monetary or other valuable consideration exchanged between the Parties with respect to the Agreement or this DPA.
2.7. Company shall comply with the obligations of, and provide the level of privacy protection required by, Data Protection Law.
3. Instructions
3.1. Company will Process Customer Personal Data to provide the Services and in accordance with Customer’s documented instructions.
3.2. The Controller’s instructions are documented in this DPA, the Agreement, and any applicable statement of work.
3.3. Customer may reasonably issue additional instructions as necessary to comply with Data Protection Law. Company may charge a reasonable fee to comply with any additional instructions.
3.4. Company is prohibited from (i) Selling or Sharing Customer Personal Data, (ii) retaining, using, or disclosing Customer Personal Data for any purpose other than for the specific purpose documented in the Customer instructions, (iii) retaining, using, or disclosing Customer Personal Data outside of the direct business relationship between Customer and Company, and (iv) combining Customer Personal Data with Personal Data obtained from, or on behalf of, sources other than Customer, except as expressly permitted under applicable Data Protection Law.
3.5. Company certifies that it understands the Processing restrictions set forth in this DPA and will comply with them.
3.6. Unless prohibited by applicable law, Company will inform Customer if Company is subject to a legal obligation that requires Company to Process Customer Personal Data in contravention of Customer’s documented instructions. Company will inform Customer without undue delay if, in its opinion, an instruction infringes Data Protection Law.
3.7. Customer shall not enter into the Services, and shall not otherwise instruct Company to Process, any Special Categories of Personal Data or other Prohibited Data as defined in the Master Customer Agreement. Customer shall not include any Personal Data in prompts directed at AI systems designated as “restricted” in Annex III. Company designates as restricted any AI system whose provider is established in, or controlled from, a country without an adequacy decision, unless Company has established that appropriate safeguards under Art. 46 EU GDPR ensure an essentially equivalent level of protection; Company maintains this designation and notifies changes to it in accordance with Section 6.3. Company is working on a tool to verify prompts on their creation or amendment and will not execute an unverified prompt against a restricted system.
4. Personnel
4.1. Company will ensure that all personnel authorized to Process Customer Personal Data are subject to an obligation of confidentiality.
5. Security and Personal Data Breaches
5.1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Company will implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including the measures listed in Annex II.
5.2. Customer acknowledges that the security measures in Annex II are appropriate in relation to the risks associated with Customer’s intended Processing and will notify Company prior to any intended Processing for which Company’s security measures may not be appropriate.
5.3. Company will notify Customer without undue delay after becoming aware of a Personal Data Breach involving Customer Personal Data. If Company’s notification is delayed, it will be accompanied by reasons for the delay.
6. Subprocessing
6.1. Customer hereby authorizes Company to engage Subprocessors. A list of Company’s current Subprocessors is included in Annex III. Where Company is Peec AI US Inc., Peec AI GmbH Processes Customer Personal Data as its Subprocessor.
6.2. Company will enter into a written agreement with Subprocessors which imposes the same data protection obligations as set out in this DPA, in particular sufficient guarantees to implement appropriate technical and organizational measures. Company remains fully liable to Customer for the performance of each Subprocessor’s obligations.
6.3. Company will notify Customer at least fourteen (14) days prior to any intended change to Subprocessors. Customer may object to the addition of a Subprocessor based on reasonable grounds relating to a potential or actual violation of Data Protection Law by providing written notice detailing the grounds of such objection within fourteen (14) days following Company’s notification of the intended change. Customer and Company will work together in good faith to address Customer’s objection. If Company chooses to retain the Subprocessor, Company will inform Customer at least fourteen (14) days before authorizing the Subprocessor to Process Customer Personal Data, and either party may immediately discontinue providing or using the relevant parts of the Services, as applicable, and may terminate the relevant parts of the Services within fourteen (14) days. Where the engagement of a new Subprocessor is required at short notice to maintain the security, integrity or availability of the Services, Company may engage it with immediate effect and will notify Customer without undue delay; Customer may object within fourteen (14) days following that notification, and the preceding sentences of this Section 6.3 apply accordingly.
7. Assistance
7.1. Taking into account the nature of the Processing, and the information available to Company, Company will assist Customer, including, as appropriate, by implementing technical and organizational measures, with the fulfillment of Customer’s own obligations under Data Protection Law to: comply with requests to exercise Data Subject Rights; conduct data protection impact assessments, and prior consultations with Supervisory Authorities; and notify a Personal Data Breach.
7.2. Company may charge a reasonable fee for assistance under this Section 7. If Company is at fault, Company and Customer shall each bear their own costs related to assistance.
7.3. Upon receiving notice from Company that it is unable to comply with Data Protection Law or this DPA, Customer may direct Company to take reasonable and appropriate steps to stop and remediate unauthorized Processing of Customer Personal Data.
8. Audit
8.1. Upon reasonable request, Company must make available to Customer all information necessary to demonstrate compliance with the obligations of this DPA and allow for and contribute to audits, including inspections, as mandated by a Supervisory Authority or reasonably requested no more than once per year by Customer with at least thirty (30) days’ prior notice, and performed by Customer or by an independent auditor mandated by Customer who is bound by confidentiality obligations and is not a competitor of Company. The foregoing shall only extend to those documents and facilities relevant and material to the Processing of Customer Personal Data and shall be conducted during normal business hours and in a manner that causes minimal disruption.
8.2. Company will inform Customer if Company believes that Customer’s instruction under Section 8.1 infringes Data Protection Law. Company may suspend the audit or inspection or withhold requested information until Customer has modified or confirmed the lawfulness of the instructions in writing.
8.3. Company and Customer each bear their own costs related to an audit.
9. International Data Transfers
9.1. Customer hereby authorizes Company to perform International Data Transfers to any country deemed to have an adequate level of data protection by the European Commission, UK government, or the competent authorities, as appropriate; on the basis of the EU-US Data Privacy Framework; or on the basis of adequate safeguards in accordance with Data Protection Law.
9.2. If a transfer of Customer Personal Data from Peec AI GmbH to Customer constitutes an International Data Transfer under the EU GDPR, Peec AI GmbH and Customer hereby conclude Module 4 (processor-to-controller) of the SCCs, which are incorporated by reference and completed as follows: the “data exporter” is Peec AI GmbH, on whose behalf Company concludes the SCCs where Company is Peec AI US Inc.; the “data importer” is Customer; the optional docking clause in Clause 7 is implemented; the optional redress clause in Clause 11(a) is struck; the SCCs are governed by the laws of Germany (Clause 17); the courts of Berlin, Germany, have jurisdiction (Clause 18); Annex I of the SCCs is Annex I to this DPA.
9.3. If Company’s compliance with Data Protection Law applicable to International Data Transfers is affected by circumstances outside of Company’s control, including if a legal instrument for International Data Transfers is invalidated, amended, or replaced, then Customer and Company will work together in good faith to reasonably resolve such non-compliance. In the event that additional, replacement or alternative standard contractual clauses are approved by Supervisory Authorities, Company reserves the right to amend the Agreement and this DPA by adding to or replacing, the standard contractual clauses that form part of it at the date of signature in order to ensure continued compliance with Data Protection Law.
10. Termination and return or deletion
10.1. This DPA is terminated upon the termination of the Agreement. Section 10.2 and any other provision which by its nature should survive termination remain in effect.
10.2. Customer may export or request return of Customer Personal Data during the retrieval period set out in the Agreement or, if none applies, for thirty (30) days after termination of the Agreement. Deletion from production systems shall be completed within thirty (30) days after the end of that period, unless applicable law requires storage. Copies contained in backups shall be deleted in the ordinary course of the backup cycle and in any event no later than thirty (30) days after deletion from production systems.
11. Replacement of Prior Data Processing Agreements
11.1. This DPA replaces any data processing agreement previously concluded between Company or Peec AI GmbH and Customer with respect to the Services (a “Prior DPA”), with effect from the date on which Customer accepts this DPA.
11.2. Processing carried out before that date remains governed by the Prior DPA. Rights and obligations that arose under the Prior DPA before that date, in particular in relation to Personal Data Breaches, audits and claims, remain unaffected.
ANNEX I
DESCRIPTION OF THE TRANSFER
A. LIST OF PARTIES
Data exporter:
Name: Peec AI GmbH (where Company is Peec AI US Inc., represented by Company)
Address: Karl-Liebknecht-Straße 14, 10178 Berlin, Germany
Contact person’s name, position and contact details: privacy@peec.ai
Activities relevant to the data transferred under these Clauses: Company provides its services to Customer as described in the Agreement and Processes Personal Data on behalf of Customer in that context.
Signature and date: Executed via acceptance of the Agreement and dated on the day of acceptance.
Role (controller/processor): Processor on behalf of Customer, or Subprocessor where Company is Peec AI US Inc. or Customer acts on behalf of a Third-Party Controller
Data importer:
Name: Customer (as defined above)
Address: the address associated with Customer’s account, as maintained by the Customer in their account settings.
Contact person’s name, position and contact details: the email address associated with Customer’s account, as maintained by the Customer in their account settings.
Activities relevant to the data transferred under these Clauses: Customer receives Company’s services as described in the Agreement and Customer provides Personal Data to Company in that context.
Signature and date: Executed via acceptance of the Agreement and dated on the day of acceptance.
Role (controller/processor): Controller, or Processor on behalf of Third-Party Controller
B. DESCRIPTION OF INTERNATIONAL DATA TRANSFER
Categories of Data Subjects whose Personal Data is transferred:
1.. Persons employed by Customer, or by its customers or affiliates
2.. Individuals named in prompt sets created by the Customer
. Individuals named in results generated in response to prompt sets, to the extent stored in Customer’s workspace
. Where the Agent Analytics feature is enabled, visitors to the Customer’s website
Categories of Personal Data transferred:
2.. Prompt set configuration data (content of prompt sets and record of which user created or amended them)
3.. Results data stored in workspace (to the extent containing personal data)
. Support communications content
. Operational and error data associated with user identifier
. Server access log data – Agent Analytics only (IP address, request method, requested URL, response status, user agent, country code)
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialized training), keeping a record of access to the data, restrictions for onward transfers or additional security measures:
. Not applicable. – Not applicable.
The frequency of the transfer (e.g., whether the data is transferred on a one-off or continuous basis): On a continuous basis.
Nature of the processing: Collection, storage, structuring, retrieval, analysis and erasure of the content which the Customer and its users enter into the platform, together with the results generated in response to it. In particular: the creation and storage of prompt sets and workspace settings; the transmission of prompt content to the AI systems selected by the Customer and to the providers used to execute those queries; the storage of the results in Customer’s workspace and their presentation in reports and dashboards; the handling of support communications; and the processing of operational and error data to the extent necessary to operate, secure and maintain the Services for Customer.
Where Customer enables the Agent Analytics feature, Company receives server access log data relating to Customer’s website. The data are transmitted from Customer’s own infrastructure or through an integration configured by Customer within Customer’s own environment (currently: Cloudflare Workers, Vercel Log Drains, Akamai DataStream, AWS CloudFront, Google Cloud CDN, a WordPress plugin, a generic webhook or a direct file upload). Records identified as originating from AI crawlers and agents are stored; all other records are discarded on ingest. Where filtering does not take place before transmission, the transmitted set includes the IP addresses of visitors to Customer’s website.
Purpose(s) of the data transfer and further processing: (A) Providing the core features of the Services to the Customer, in particular the execution of the prompt sets configured by the Customer against the AI systems selected by it and the provision of the results in the Customer’s workspace; (B) providing customer support to the Customer and its users; (C) operating, securing and maintaining the Services for the Customer; and (D) where the Customer enables the Agent Analytics feature, analyzing the server access log data provided by the Customer in order to report on AI crawler activity on the Customer’s website.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: Company shall process Customer Personal Data for the term of the Agreement. Following its termination the Customer Personal Data shall be deleted or returned in accordance with Section 10.2. Retention periods applying during the term are: server access log data from Agent Analytics: thirty (30) days after receipt, deleted automatically; error reports and system logs at the sub-processor Sentry: 90 and 30 days respectively; all other data: for the term of the account.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing: For the subject matter and nature of the Processing, reference is made to the Agreement and this DPA. The Processing will take place for the duration of the Agreement.
ANNEX II
TECHNICAL AND ORGANIZATIONAL MEASURES INCLUDING TECHNICAL AND ORGANIZATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
The Company shall be entitled and obliged to take decisions on use of technical and organizational security measures to ensure necessary (and agreed) level of security of the data.
However, in any case the Company shall implement the following measures agreed with Customer:
1. Company implements technical and organizational security measures appropriate to the nature of the processing. Services are hosted within the European Union on Google Cloud Platform, principally in europe-west3 (Frankfurt), together with a managed ClickHouse Cloud instance in europe-west4 (Netherlands) and Firestore in the eur3 European multi-region (Belgium and the Netherlands). Firebase Authentication is operated by the provider in the United States and is not configurable; the transfer basis for that component is stated in Annex III. Measures include least-privilege access controls, secure configuration practices, logging/monitoring, and controlled access to production systems. Company follows industry good practices for secure software development and cloud security.
2. Personal data is encrypted in transit via HTTPS/TLS. Backups are encrypted at rest using cloud-provider managed encryption (GCP). Company does not use a customer-managed KMS and relies on managed encryption controls. Where feasible, exposure of personal data in operational systems is minimized.
3. Confidentiality and integrity are ensured through access restrictions, authentication, and secure communications. Availability and resilience are supported through cloud-based infrastructure, monitoring, and the ability to restore from encrypted backups. Access to production data is limited to authorized roles (Engineering and CX Lead) on a need-to-know basis.
4. Company performs daily encrypted backups and maintains the capability to restore access to personal data following incidents. The target recovery time is within 4 hours.
5. Company regularly evaluates the effectiveness of security measures through security testing activities. Dependency security is supported via automated monitoring tools (e.g., Dependabot) to identify and remediate known vulnerabilities.
6. Access to personal data is restricted to authorized personnel based on role and necessity. Production access is limited to Engineering and the CX Lead. Customer authentication supports SSO. Internal access is managed through controlled authentication and authorization.
7. Personal data is protected during transmission using HTTPS/TLS encryption in transit for communications with Peec AI services.
8. Stored personal data is protected through cloud security controls, access restrictions, and encrypted backups. Data is hosted in the European Union, primarily in Germany, using GCP.
9. Personal data is stored in cloud data centers operated by GCP in the European Union. Physical security is provided and maintained by this cloud provider as part of its data center operations.
10. Company operates in a hybrid work model. Remote work is enabled through company-issued laptops that are centrally provisioned and managed using Deeploi. Deeploi is used to enforce baseline security controls, including device configuration, access provisioning and de-provisioning, and centralized management of user access to company systems and applications. Access to internal resources is restricted to managed devices and authenticated users. Secure access controls and device-level protections are applied to mitigate risks associated with remote work.
ANNEX III
LIST OF SUBPROCESSORS
Customer authorizes Company to engage the following Subprocessors:
Name: Firestore; Google Cloud EMEA Limited
Address: 70 Sir John Rogerson’s Quay, Dublin 2, Ireland
Location of processing: European Union (eur3 multi-region: Belgium and the Netherlands)
Description of processing: Storage of user account data necessary to provide the services, including e-mail address, name, organization and profile information.
Transfer basis: Not required (processing in the EU)
Name: Firebase Authentication; Google Cloud EMEA Limited
Address: 70 Sir John Rogerson’s Quay, Dublin 2, Ireland
Location of processing: United States – fixed provider constraint, not a configurable tenant setting
Description of processing: Authentication: user registration and login; processes e-mail address, authentication credentials and IP address for security purposes.
Transfer basis: EU-U.S. Data Privacy Framework (onward transfer to Google LLC); SCCs under Google’s Cloud Data Processing Addendum
Name: Google Cloud Platform; Google Cloud EMEA Limited
Address: 70 Sir John Rogerson’s Quay, Dublin 2, Ireland
Location of processing: European Union (europe-west3 Frankfurt; individual buckets in EU and europe-west1)
Description of processing: Hosting of the application infrastructure: backend services, AlloyDB, Memorystore Redis, BigQuery, object storage and the peec-data-prd stack.
Transfer basis: Not required (processing in the EU)
Name: ClickHouse, Inc.
Address: 650 Castro St., Suite 120 #92426, Mountain View, CA 94041, USA
Location of processing: European Union (europe-west4, Netherlands; ClickHouse Cloud accessed via Private Service Connect)
Description of processing: Columnar analytics database: usage and event data with user identifiers; server access log data ingested through Agent Analytics.
Transfer basis: Processing in the EU; for access from the US: EU-U.S. Data Privacy Framework
Name: Posthog; Posthog Inc.
Address: 2261 Market Street #4008, San Francisco, CA 94114, United States
Location of processing: United States
Description of processing: Product analytics: in-app usage events, session identifiers, technical metadata; after login events may be associated with an account ID or e-mail address.
Transfer basis: EU-U.S. Data Privacy Framework
Name: Sentry; Functional Software Inc.
Address: 45 Fremont Street, 8th Floor, San Francisco, CA 94105, United States
Location of processing: European Union (Germany, Sentry DE region)
Description of processing: Error and performance monitoring: error messages, stack traces, timestamps, user or session identifiers. Retention 90 days for error reports, 30 days for system logs.
Transfer basis: Processing in the EU; for access from the US: SCCs (Modules 2 and 3) under the provider’s data processing addendum
Name: Not Just Tickets Ltd (t/a Plain)
Address: 3rd Floor, 1 Ashley Road, Altrincham, WA14 2DT, UK
Location of processing: United Kingdom (primary hosting on AWS in the UK)
Description of processing: In-app customer support and support via email and Slack: message content, contact details (name, email address), and related metadata (e.g. technical and usage data) of the Data Controller’s users.
Transfer basis: Adequacy decision for the United Kingdom
Name: Qdrant Solutions GmbH
Address: Chausseestraße 86, 10115 Berlin, Germany
Location of processing: European Union (europe-west3 Frankfurt)
Description of processing: Vector store: embeddings derived from harvested content and, where applicable, from customer content.
Transfer basis: Not required (processing in the EU)
Name: OpenAI Ireland Ltd / OpenAI, L.L.C.
Address: 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland
Location of processing: United States
Description of processing: Model inference. The customer’s prompt string is transmitted and the model response returned; also used as an internal tool on harvested content.
Transfer basis: SCCs under the provider’s data processing addendum
Name: Anthropic Ireland, Limited
Address: 6th Floor, South Bank House, Barrow Street, Dublin 4, Ireland
Location of processing: United States
Description of processing: Model inference, as above.
Transfer basis: SCCs (Modules 2 and 3) under the provider’s data processing addendum
Name: Google Cloud EMEA Limited (Vertex AI)
Address: 70 Sir John Rogerson’s Quay, Dublin 2, Ireland
Location of processing: European Union
Description of processing: Model inference, as above.
Transfer basis: Not required (processing in the EU)
Name: Mistral AI SAS
Address: 15 rue des Halles, 75001 Paris, France
Location of processing: European Union
Description of processing: Model inference, as above.
Transfer basis: Not required (processing in the EU)
Name: X.AI LLC
Address: 1450 Page Mill Rd, Palo Alto, CA 94304
Location of processing: United States
Description of processing: Model inference, as above.
Transfer basis: SCCs under the provider’s data processing addendum
Name: Perplexity AI, Inc.
Address: 115 Sansome St, Suite 900, San Francisco, CA 94104, USA
Location of processing: United States
Description of processing: Model inference, as above.
Transfer basis: EU-U.S. Data Privacy Framework
Name: Google Cloud EMEA Limited (Gemini API, direct execution)
Address: 70 Sir John Rogerson’s Quay, Dublin 2, Ireland
Location of processing: European Union
Description of processing: Model inference invoked directly rather than through Vertex AI.
Transfer basis: Not required (processing in the EU)
Name: Google Cloud EMEA Limited (Natural Language API)
Address: 70 Sir John Rogerson’s Quay, Dublin 2, Ireland
Location of processing: European Union
Description of processing: Text analysis of harvested content.
Transfer basis: Not required (processing in the EU)
Name: OpenRouter, Inc.
Address: 169 Madison Avenue #2404, New York, NY 10016, USA
Location of processing: United States (router); onward providers: fixed per model (e.g. Amazon Web Services and Google for Claude models; Novita, Parasail and Venice for DeepSeek V4 Pro)
Description of processing: Forwards the prompt string to an upstream provider selected by the router.
Transfer basis: SCCs under the provider’s data processing agreement
Name: Alibaba Cloud (Model Studio)
Address: Alibaba (Netherlands) B.V., Herengracht 448, 1017CA Amsterdam
Location of processing: Storage: European Union (Frankfurt). Processing: global, locations not determined by the provider; operator established in the People’s Republic of China
Description of processing: Model inference for deepseek-v4-pro and qwen-3-6-plus with search grounding; no other services used.
Transfer basis: SCCs (Modules 2 and 3) under the provider’s data processing addendum. Restricted (Section 3.7).