Subprocessor register
The full list of entities processing data on our behalf, with the scope of entrustment, the country of processing and the basis for any transfer outside the European Economic Area.
This is an English rendering for convenience. The binding version is the Polish one, available at aivatary.com/pl/podprocesorzy/. In case of discrepancy, the Polish text prevails.
Why this is a separate document
It carries its own version number and date, apart from the privacy policy. The reason is practical: changing a speech synthesis provider has nothing to do with your rights under the GDPR, so it should not move the version number of a document you consent to. The register changes more often, the policy less.
Entities processing data on our behalf
| Entity | Role and service | Data categories | Country of processing | Transfer basis |
|---|---|---|---|---|
| OpenAI Ireland Ltd | The language model phrasing the answer, vector embeddings of the knowledge base, the understanding layer in voice sessions together with turning the recorded speech into text (transcription happens inside the same session, at the same provider) | The question, knowledge base passages retrieved for the answer, current conversation history, and when building a presentation also the content of pages from the website you point us at | Ireland, with possible processing in the United States | Standard contractual clauses (Art. 46(2)(c) GDPR), contained in the provider's data processing agreement accepted together with its terms of service |
| ElevenLabs | Speech synthesis, turning the answer into audio in voice sessions and in the widget greeting | The text of the answer to be read aloud | United States | Standard contractual clauses (Art. 46(2)(c) GDPR), contained in the provider's data processing agreement accepted together with its terms of service |
| HeyGen Technology Inc. | Generating the character and two short video loops of the customer's own avatar, ordered by the customer in the panel. Data reaches the provider only while the avatar is being built, never during conversations | A description of the character's appearance assembled from the order settings (gender and age range of the character, setting, style of dress, accent colour), the recording script with the assistant's name and the order identifier, without the company name or the content of its website. For a character built from a photograph, also the photograph of the person the customer designates | United States | Standard contractual clauses (Art. 46(2)(c) GDPR), Module Three (processor to processor), contained in the provider's data processing agreement accepted together with its terms of service |
| Twilio | Sending and receiving SMS messages and telephony: calls to the customer's number handled by the assistant, including transferring the call to a number set by the customer. The channels are off by default and enabled only at the customer's request | Caller, sender and recipient phone numbers, SMS body, call audio during the connection, call data: time, duration and outcome | United States | Standard contractual clauses (Art. 46(2)(c) GDPR), contained in the provider's data processing agreement accepted together with its terms of service |
| Microsoft Ireland Operations Ltd | The Microsoft Teams channel and the assistant's entry into a video meeting, where the picture and sound of the conversation pass through a Microsoft service | Message content in the Teams channel, meeting picture and sound, participant display name | Ireland, with possible processing in the United States | Standard contractual clauses (Art. 46(2)(c) GDPR), contained in the provider's data processing agreement accepted together with its terms of service |
| Slack | The Slack channel, where the assistant picks up mentions and answers in the same thread. The channel is off by default and enabled only at the customer's request | The text of the answer posted into the thread, channel and thread identifier, workspace and user identifier, and the speaker's display name fetched to recognise the contact | United States | Standard contractual clauses (Art. 46(2)(c) GDPR), contained in the provider's data processing agreement accepted together with its terms of service |
| OVHcloud | The data centre running the application, the database and media transport | All data stored by the platform | Poland, Warsaw | Not applicable, processing in the European Union |
| Spacemail | Outbound and inbound mail server for the aivatary.com domain | Email address, subject and message body | United States | Standard contractual clauses (Art. 46(2)(c) GDPR), contained in the provider's data processing agreement accepted together with its terms of service |
Release 1.6 corrects the incomplete description of Twilio's activities in earlier releases. Twilio has handled telephony since the beginning of September 2026, and SMS messages also in the direction towards us. Publishing the correction does not change the date this feature was launched and does not replace the required authorisation of sub-processing.
For part of the data, in particular data about calls and messages, Twilio also acts as a separate controller under its own terms. The Ada test drive on our website is not processing on behalf of a customer: there we are the controller, and the recipients of the data, Twilio included for the SMS code and the call, are listed in Part III of the privacy policy.
What is not on this list, and why
Several components that are usually separate providers elsewhere run on our own servers. They are therefore not subprocessors and do not appear in the table:
| Component | Where it runs |
|---|---|
| Voice transport (LiveKit) | Our server in Warsaw, run alongside the application |
| Database and vector search | Our server, PostgreSQL with the pgvector extension |
| Job queue | Our database, with no external broker |
| Push notifications | Our own implementation of the Web Push standard, with no intermediary |
This website loads not a single asset from another company's servers. Fonts, styles and the conversation script come from our own domain. That is why there is no consent banner here: there is nothing to declare.
Changing a subprocessor
- We announce an intended addition or replacement at least 30 days in advance, naming the entity, the scope of operations entrusted to it, the country of processing and the basis for any transfer outside the European Economic Area.
- Within that period the customer may raise a reasoned objection. If no solution is found, the customer may terminate the contract in the part the objection concerns.
- Every change increments this register's version number and is recorded in the history below.
Version history
| Version | In force from | Scope of change |
|---|---|---|
| 1.0 | 24 August 2026 | First release of the register |
| 1.1 | 9 September 2026 | Microsoft Ireland Operations Ltd added: the Teams channel and the assistant's entry into a video meeting |
| 1.2 | 9 September 2026 | OpenAI entrustment extended to the content of pages from a website the customer points us at, processed when building a presentation |
| 1.3 | 12 September 2026 | Slack added: the Slack channel, where the assistant picks up mentions and answers in the thread |
| 1.4 | 21 September 2026 | HeyGen Technology Inc. added: generating the character and video loops of the customer's own avatar, ordered in the panel |
| 1.5 | did not take effect: published on 24 September 2026 with the date 8 October 2026, replaced by version 1.6 | Twilio's description extended to telephony: calls to the customer's number and transferring them. Twilio has handled telephony since it was launched, while earlier versions of the register listed SMS only |
| 1.6 | 27 September 2026 | Correction of Twilio's description dated on publication instead of waiting until 8 October 2026: SMS messages in both directions and telephony, which Twilio has handled since the beginning of September 2026 |
You need a processing agreement
The template we sign with customers is available to read before any sales conversation.