Subprocessor register
The full list of entities processing data on our behalf, with the scope of entrustment, the country of processing and the basis for any transfer outside the European Economic Area.
This is an English rendering for convenience. The binding version is the Polish one, available at aivatary.com/pl/podprocesorzy/. In case of discrepancy, the Polish text prevails.
Why this is a separate document
It carries its own version number and date, apart from the privacy policy. The reason is practical: changing a speech synthesis provider has nothing to do with your rights under the GDPR, so it should not move the version number of a document you consent to. The register changes more often, the policy less.
Entities processing data on our behalf
| Entity | Role and service | Data categories | Country of processing | Transfer basis |
|---|---|---|---|---|
| OpenAI Ireland Ltd | The language model phrasing the answer, vector embeddings of the knowledge base, the understanding layer in voice sessions | The question, knowledge base passages retrieved for the answer, current conversation history | Ireland, with possible processing in the United States | Standard contractual clauses (Art. 46(2)(c) GDPR), contained in the provider's data processing agreement accepted together with its terms of service |
| ElevenLabs | Speech synthesis, turning the answer into audio in voice sessions and in the widget greeting | The text of the answer to be read aloud | United States | Standard contractual clauses (Art. 46(2)(c) GDPR), contained in the provider's data processing agreement accepted together with its terms of service |
| Twilio | Sending SMS messages. The channel is off by default and enabled only at the customer's request | Recipient phone number, message body | United States | Standard contractual clauses (Art. 46(2)(c) GDPR), contained in the provider's data processing agreement accepted together with its terms of service |
| OVHcloud | The data centre running the application, the database and media transport | All data stored by the platform | Poland, Warsaw | Not applicable, processing in the European Union |
| Spacemail | Outbound and inbound mail server for the aivatary.com domain | Email address, subject and message body | United States | Standard contractual clauses (Art. 46(2)(c) GDPR), contained in the provider's data processing agreement accepted together with its terms of service |
What is not on this list, and why
Several components that are usually separate providers elsewhere run on our own servers. They are therefore not subprocessors and do not appear in the table:
| Component | Where it runs |
|---|---|
| Voice transport (LiveKit) | Our server in Warsaw, run alongside the application |
| Speech recognition | OpenAI, together with the voice conversation model |
| Database and vector search | Our server, PostgreSQL with the pgvector extension |
| Job queue | Our database, with no external broker |
| Push notifications | Our own implementation of the Web Push standard, with no intermediary |
This website loads not a single asset from another company's servers. Fonts, styles and the conversation script come from our own domain. That is why there is no consent banner here: there is nothing to declare.
Changing a subprocessor
- We announce an intended addition or replacement at least 30 days in advance, naming the entity, the scope of operations entrusted to it, the country of processing and the basis for any transfer outside the European Economic Area.
- Within that period the customer may raise a reasoned objection. If no solution is found, the customer may terminate the contract in the part the objection concerns.
- Every change increments this register's version number and is recorded in the history below.
Version history
| Version | In force from | Scope of change |
|---|---|---|
| 1.0 | 24 August 2026 | First release of the register |
You need a processing agreement
The template we sign with customers is available to read before any sales conversation.