Sub-processors

This page separates two groups: the sub-processors under Art. 28 GDPR that take part in processing your data, and further providers that process only data for which PrivatAI is itself the controller. The distinction is legally material — only the first group falls under Art. 28 — and the second is listed anyway, because transparency about the whole data path is worth more than a formally narrower list.

Controller: Artur Parutkin (sole proprietorship), Hamburg. Data-protection contact: datenschutz@privatai.com — address see imprint.

Core data stays in the EU. Your prompts and documents are processed exclusively in the EU (inference in France, hosting in Germany) and are not stored. Ancillary data (email, payment) may be processed via US providers — safeguarded by EU Standard Contractual Clauses.

1. Sub-processors under Art. 28 GDPR

These providers process data you entrust to us as our customer — prompts, outputs and the platform data in which they are processed. A data processing agreement under Art. 28 GDPR is in place with each.

Scaleway S.A.S.

PurposeAI inference (running the language models)

DataPrompts and outputs — not stored, not logged, no training

LocationFrankreich (EU)

TransferDPA Art. 28; no third-country transfer

Hetzner Online GmbH

PurposeHosting, servers, database

DataAccount, usage and platform content data

LocationGermany (EU)

TransferDPA Art. 28; EU/EEA only

2. Further providers (not sub-processors within the meaning of the DPA)

These providers process account, payment and correspondence data for which PrivatAI is itself the controller. They are not part of the processing you entrust to us and are therefore not sub-processors within the meaning of the DPA. Data processing agreements are in place with both, with PrivatAI as controller.

Resend (Plus Five Five, Inc.)

PurposeTransactional and newsletter email

DataEmail addresses, names, email content

LocationUSA

TransferDPA + EU Standard Contractual Clauses (2021/914)

Stripe Payments Europe, Ltd.

PurposePayment processing

DataPayment, billing and identity data (KYC)

LocationIreland (EU); possibly US affiliates

TransferDPA + EU Standard Contractual Clauses

Inbound email. The MX records for privatai.com point to Resend’s inbound infrastructure (Amazon SES, Ireland). Amazon is therefore a sub-processor of Resend, disclosed on Resend’s own list, rather than an additional provider of PrivatAI’s. Please do not send us third parties’ personal data by email — the service itself, not the mail path, is the place for such content.

3. Planned

The following provider is envisaged but not yet engaged: no contract is currently in place and no data is transmitted. Affected customers will be informed with reasonable advance notice before any engagement.

T-Systems International GmbH (Telekom) planned — not yet engaged

PurposeAI inference with German hosting (EU models only, T-Cloud Public)

DataPrompts and outputs — not stored, no training

LocationGermany (EU)

TransferDPA (EU SCC Art. 28, 2021/915); EU models only

Further notes

Web analytics run on a self-hosted instance (GoatCounter) on our EU infrastructure — no separate sub-processor, no third-party trackers, no cookies.

We inform affected customers of intended changes to this list (adding or replacing a sub-processor) with reasonable advance notice and grant a right to object.

Last updated: August 2026