Legal · Sub-processors

Sub-processors

Last updated: 12 July 2026

Current sub-processors

Sub-processor	What it processes	Location	Transfer safeguard
Hetzner Online GmbH (Germany)	EU application hosting and compute; personal data in transit (accounts, content, connected-account tokens, AI prompts)	Nuremberg, Germany (EEA)	Processed within the EEA
DigitalOcean, LLC (United States)	Managed PostgreSQL (primary database — all stored personal data), Valkey cache and task broker, and object storage (assets and database backups)	Frankfurt, Germany — region fra1 (EEA)	US-incorporated provider — EU-US Data Privacy Framework / Standard Contractual Clauses
Stripe Payments Europe, Ltd. (Ireland), with Stripe, Inc. group affiliates	Payment processing — payment card details (collected directly by Stripe), billing name and address, transaction and invoice history	Ireland (EEA), with processing by Stripe, Inc. in the United States	US group affiliates — EU-US Data Privacy Framework / Standard Contractual Clauses
Brevo (Sendinblue SAS, France)	Transactional email — account, billing and service notifications	France (EEA)	Processed within the EEA
Google Ireland Limited (Google Workspace / Gmail)	Incoming corporate and support email — messages you send to SmashOne mailboxes (sender address, message content)	European Union, with global Google infrastructure	US-headquartered group — EU-US Data Privacy Framework / Standard Contractual Clauses
Telegram FZ-LLC (United Arab Emirates)	Messaging channel — customer DMs, AI replies and support conversations (message content and attachments, Telegram user id and username, timestamps)	United Arab Emirates, with global message infrastructure	Third-country processor — Standard Contractual Clauses; processing limited to the messages customers choose to send
Google LLC (Vertex AI)	AI processing for the assistant and content generation (customer and end-customer content)	SmashOne-owned Google Cloud project — currently a global processing location	May process outside the EEA — EU-US Data Privacy Framework / Standard Contractual Clauses
Cloudflare, Inc. (United States)	DNS, content delivery, reverse proxy and web application firewall (IP addresses, request metadata, data in transit)	Global edge network	US-incorporated provider — EU-US Data Privacy Framework / Standard Contractual Clauses
Functional Software, Inc. (Sentry, United States)	Application error and performance monitoring, configured with PII minimisation	Sentry EU region (Germany)	US-incorporated provider — Standard Contractual Clauses
PostHog, Inc. (United States)	Pseudonymous, server-side product analytics	PostHog EU Cloud	US-incorporated provider — EU-US Data Privacy Framework / Standard Contractual Clauses
ScrapingBee SAS (France)	Retrieves your public business website so the assistant can build its knowledge base	France (EEA)	Processed within the EEA

Who processes data for us

The sub-processors that help run SmashOne — what each does, where it processes data, and the safeguard for any transfer outside the EEA.

Overview

SmashOne uses a small number of carefully selected sub-processors to operate the service, including Google Workspace (Gmail) for inbound email processing at info@smashone.ai. The table below lists each one, what it processes, where it processes personal data, and the safeguard for any transfer outside the European Economic Area (EEA). We keep this list current and give customers at least 30 days' notice before we add or replace a sub-processor, as set out in our Data Processing Agreement.

AI processing

Google LLC (Vertex AI) powers the AI assistant that drafts replies and content. It runs in a SmashOne-owned Google Cloud project that is currently configured with a global processing location, so some processing may take place outside the EEA; those transfers rely on the EU-US Data Privacy Framework or Standard Contractual Clauses. SmashOne and its AI sub-processor do not use your data to train, fine-tune, or improve any general-purpose AI model.

International transfers

GDPR · Chapter V

Where a sub-processor is US-incorporated or processes personal data outside the EEA, the transfer relies on the European Commission's EU-US Data Privacy Framework adequacy decision where applicable, or on Standard Contractual Clauses with supplementary technical and organisational safeguards. This includes our payment sub-processor, Stripe Payments Europe, Ltd. (Ireland), whose Stripe, Inc. group affiliates process payment data in the United States under the same safeguards; it is listed in the register above.

DPF adequacySCC safeguards

Changes to this list

DPA · Article 28

We review this list regularly and update it whenever a sub-processor is added, replaced, or removed. For any change that adds a new sub-processor, we give customers at least 30 days' notice so you can raise a reasonable data-protection objection, as described in our Data Processing Agreement. Questions about sub-processors: info@smashone.ai.

30 days noticeObject on DP grounds