Sub-processors and Third-Party Service Providers
Last updated: 30 October 2026
1. About This Page
TidyChat is operated by Aida Technologies S.R.L., a company registered in Romania.
We use selected third-party service providers to operate, maintain, secure, and improve the Service.
Where we process personal data on behalf of our business customers, certain providers may act as sub-processors under our Data Processing Agreement (DPA).
Other providers support our own business operations, such as billing, analytics, and account administration, and may act as processors or independent controllers depending on the processing activity.
This page provides information about these providers and their respective roles.
2. Sub-processors for Customer Workspace Data
The following providers support the processing of customer workspace data where the relevant services or features are used.
| Provider | Purpose | Processing Location |
|---|---|---|
| Hetzner Online GmbH | Application hosting, database infrastructure, and storage | Germany, EU, subject to the actual deployment configuration |
| OpenAI Ireland Ltd. and applicable OpenAI affiliates | AI model inference, automated replies, lead qualification, and related AI functionality | EEA and other locations, including the United States, depending on the applicable service and processing configuration |
| Anthropic Ireland, Limited and applicable Anthropic affiliates | Alternative and backup AI model inference (Claude) for automated replies, lead qualification, and related AI functionality | United States and other locations, depending on the applicable service and processing configuration |
| Cloudflare, Inc. | AI gateway that routes and logs requests to AI providers, and R2 object storage for media and files | Global network; R2 storage location subject to the actual deployment configuration |
Where applicable, the engagement of these providers is governed by contractual data protection obligations and appropriate international transfer safeguards.
3. Other Service Providers
We also use service providers for our own account administration, payment processing, operational monitoring, and analytics activities.
These providers are not necessarily sub-processors of customer-controlled workspace data. Their legal roles depend on the services used and the personal data involved.
| Provider | Purpose |
|---|---|
| Stripe | Payment processing, prepaid balance top-ups, billing, and refunds |
| Google Workspace | Business email and account-related communications |
| Google Analytics | Analytics for the TidyChat marketing website |
| PostHog (EU Cloud) | Product analytics and usage insights |
| Sentry (Functional Software, Inc.) | Application error monitoring and diagnostics |
| Cloudflare, Inc. | Content delivery, DNS, and security (DDoS and bot protection) for website and application traffic |
The data processed by these providers may include account details, transaction information, technical identifiers, usage events, and other information necessary for their respective functions.
Where a provider processes customer-controlled workspace personal data on our behalf, that processing is subject to the relevant sub-processor obligations under our DPA.
4. Third-Party Messaging Platforms
TidyChat allows customers to connect external messaging platforms, including WhatsApp.
These platforms provide messaging services and may process personal data under their own applicable terms, privacy policies, and data processing arrangements.
The legal role of each messaging platform depends on the specific integration and processing activity.
Where our WhatsApp gateway software is operated on infrastructure controlled by TidyChat, the gateway software itself does not constitute an independent third-party sub-processor.
Customers remain responsible for their compliance with applicable messaging platform terms and legal requirements.
5. AI Processing and Model Training
TidyChat may use authorised third-party AI model providers to support automated messaging, response generation, lead qualification, and other AI-powered features.
Relevant customer content, conversation context, and instructions may be transmitted to the selected AI provider for processing.
Our AI providers are OpenAI, our primary provider, and Anthropic (Claude), an alternative and backup provider used when we select it or when the primary provider is unavailable.
Under OpenAI's standard API data usage terms, customer data submitted through the API is not used to train or improve OpenAI's models by default, unless the API customer expressly opts in to such use.
Under Anthropic's commercial terms, inputs and outputs submitted through its API are not used to train Anthropic's models.
AI providers may undertake limited additional processing, including security and abuse monitoring, in accordance with their applicable agreements and data processing terms.
If TidyChat introduces additional AI model providers, we will update this page and provide the required advance notice under our DPA.
Any additional provider must be subject to appropriate contractual data protection obligations, international transfer safeguards where applicable, and suitable restrictions on model training using customer data.
6. International Data Transfers
Some providers or their affiliates may process or access personal data outside the European Economic Area (EEA).
Where applicable, we rely on appropriate transfer mechanisms under Chapter V of the GDPR, including:
- Adequacy decisions adopted by the European Commission.
- The EU–US Data Privacy Framework for eligible certified organisations.
- Standard Contractual Clauses (SCCs), together with supplementary safeguards where required.
- Other lawful transfer mechanisms permitted under applicable law.
The applicable mechanism depends on the provider, the relevant processing activity, and the countries involved.
7. Changes to Sub-processors
We maintain and update this page to reflect the service providers engaged in processing personal data.
Where we intend to add or replace a sub-processor processing customer workspace data, we will provide advance notice in accordance with our Data Processing Agreement.
Customers will have 15 days from the notice to object on reasonable data protection grounds, as described in our DPA.
We will make reasonable efforts to address any such objection in accordance with the DPA.
8. Contact
For questions about our sub-processors, third-party service providers, or applicable data protection arrangements, please contact us at [email protected].