Subprocessors
Who processes your data, where, and under which agreement status.
Last updated 1 November 2026Everyone who can touch your data, with honest agreement statuses. New subprocessors are announced 30 days before they process anything.
| Subprocessor | Purpose | Data it receives | Location | Status |
|---|---|---|---|---|
| Sightengine (Kozelo SAS) Paris | AI image detection | Image pixels only (images, and up to three still frames per video), no file name or metadata Deleted after processing | EU, Canada or US EU SCCs in the Sightengine DPA; Canada: EU adequacy decision | Active |
| Mistral AI SAS Paris | Plain-language summary of a scan | Scan results only, never the image Kept up to 30 days for abuse monitoring | EU EU SCCs in the Mistral DPA for any processing outside the EU | Active from 1 Nov 2026 |
| OVH GmbH Cologne, Germany | Hosting | All service data Deleted, backups included, when the service ends | Frankfurt am Main, Germany EU SCCs in the OVHcloud DPA for remote access by non-EU affiliates | Active |
| Resend (Plus Five Five, Inc.) San Francisco, USA | Transactional email | Email address, message content Message logs up to 30 days, backups 7 days | United States EU SCCs and EU-US Data Privacy Framework in the Resend DPA | Active |
| Sentry (Functional Software, Inc.) San Francisco, USA | Error monitoring for the website and API | Error reports: error message, stack trace, page or API address without its query string, browser and operating system. No IP address, cookies, account, email address, request body or uploaded content Up to 90 days | EU (Frankfurt, Germany); Sentry may access it from the United States EU-US Data Privacy Framework (Functional Software, Inc.); EU SCCs in the Sentry DPA as fallback | Active from 1 Nov 2026 |
| Cloudflare, Inc. (Turnstile) San Francisco | Bot check on sign-up, contact and newsletter forms | IP address, browser and TLS characteristics, page address Not stated in Cloudflare's Turnstile Privacy Addendum | Cloudflare global network EU SCCs in the Cloudflare Customer DPA | Active from 23 Oct 2026 |
| Stripe Payments Europe, Limited Dublin, Ireland | Payments and invoices | Billing details For the term of the agreement, longer where the law requires | Global, including the United States and India EU SCCs in the Stripe Data Transfers Addendum; EU-US Data Privacy Framework (Stripe, LLC) | Active |
| Cookiebot (Usercentrics A/S) Copenhagen, Denmark | Cookie consent | Consent record Up to 12 months | EU (Microsoft Azure, Ireland and the Netherlands); Akamai CDN, US Processing in the EU/EEA; EU SCCs for any transfer outside it | Active |
| Google Tag Manager (Google Ireland Limited) Dublin, Ireland | Delivers the consent banner, then the tags you consent to | Page address, IP address, browser details Request logs deleted within 14 days | Google data centres worldwide EU-US Data Privacy Framework (Google LLC); EU SCCs as fallback | Active |
| Google Analytics 4 (Google Ireland Limited) Dublin, Ireland | Usage statistics, after statistics consent | Pages viewed, events, device and browser details, pseudonymous ID User-level data up to 14 months | Google data centres worldwide EU-US Data Privacy Framework (Google LLC); EU SCCs as fallback | Consent-gated |
A provider is not authorized to receive customer content until this page names the legal entity, the feature, the data sent, the countries, the retention, and the transfer safeguard. New subprocessors that receive customer personal data are announced at least 30 days before they do, and you can object.
With your consent, two providers also act as independent controllers under their own terms: Microsoft Clarity (Microsoft Ireland Operations Limited, Dublin) for statistics and Google Ads (Google Ireland Limited, Dublin) for marketing. They are not subprocessors; their cookies and retention are listed in the Cookie Policy.
Agency customers can request a countersigned DPA covering this list via legal@xentavi.com.