Legal
Subprocessors
Third-party services that process personal data on behalf of PAIQ, with their location and applicable safeguards.
PAIQ RAAS, S.L. ("PAIQ", "we", "us", or "our") engages a small number of carefully selected third-party providers ("subprocessors") that process personal data on our behalf to operate the PAIQ service. This page lists every active subprocessor, the purpose of processing, the location of processing, and the legal mechanism we rely on for any transfer of data outside the European Economic Area.
This list is maintained in line with our obligations under Article 28 GDPR and the transparency requirements of our Privacy Policy. We update this page whenever we add, replace, or remove a subprocessor.
1. Product Subprocessors
These providers process personal data of PAIQ account holders and Instagram message senders as part of delivering the core service.
| Subprocessor | Purpose | Data categories | Location | Transfer mechanism |
|---|---|---|---|---|
| Hetzner Online GmbH | Cloud hosting and infrastructure | All account, billing, message, and log data | Germany (EU) | Within EU — no transfer mechanism required |
| Scaleway, S.A.S. | Encrypted off-site database backups (object storage, fr-par region) | Backup copies of all account, billing, message, and log data | France (EU) | Within EU, no transfer mechanism required |
| Stripe Payments Europe, Ltd. | Subscription billing and payment processing | Name, email, billing address, payment tokens (card numbers are not stored by PAIQ) | Ireland (EU); processing may extend to United States | No third-country transfer by PAIQ. Any transfer within the Stripe group is made by Stripe under its own terms. |
| OpenAI Ireland Limited | AI inference (GPT-4o) used to draft replies to incoming DMs | DM content, sent via API to generate a reply. OpenAI may retain it for up to 30 days for abuse monitoring, or longer where its policies or the law require; PAIQ does not direct or extend that retention | Ireland (EU); processing may extend to United States | No third-country transfer by PAIQ. Any processing in the United States is a transfer made by OpenAI under its data processing addendum. Customer data is not used to train OpenAI models. |
| Anthropic Ireland, Limited | AI inference (Claude) used to draft replies to incoming DMs | DM content, sent via API to generate a reply. Anthropic may retain it for up to 30 days for abuse monitoring, or longer where its policies or the law require; PAIQ does not direct or extend that retention | Ireland (EU); processing may extend to United States | No third-country transfer by PAIQ. Any processing in the United States is a transfer made by Anthropic under its data processing addendum, which incorporates the Standard Contractual Clauses where required. Customer data is not used to train Anthropic models. |
Meta (independent controller): Meta Platforms Ireland Ltd., Instagram and the Meta Graph API. PAIQ connects to Meta on the Customer's instruction to send and receive the Customer's Instagram direct messages. Meta processes this data as an independent controller under its own terms, not as a PAIQ sub-processor.
2. Operational Subprocessors
These providers process personal data collected through our website and marketing channels — for example, contact form submissions, conversations with our website assistant, and lead intake. They do not process Instagram DM data.
| Subprocessor | Purpose | Data categories | Location | Transfer mechanism |
|---|---|---|---|---|
| OpenAI Ireland Limited | Website voice and chat assistant ("Kemi"), via the OpenAI Realtime API | Voice audio and text transcripts of the conversation, and any contact details the visitor provides | Ireland (EU); processing may extend to United States | No third-country transfer by PAIQ. Any processing in the United States is a transfer made by OpenAI under its data processing addendum. Customer data is not used to train OpenAI models. |
| Anthropic Ireland, Limited | Backup model for the website chat assistant ("Kemi"), used only if the primary model returns an error | Text of the chat conversation, and any contact details the visitor provides | Ireland (EU); processing may extend to United States | No third-country transfer by PAIQ. Any processing in the United States is a transfer made by Anthropic under its data processing addendum, which incorporates the Standard Contractual Clauses where required. Data is not used to train Anthropic models. |
| Airtable, Inc. | Lead capture and CRM for website conversations | Name, email, conversation summary, lead status | United States | SCCs (Module 2) |
| Resend, Inc. | Transactional email delivery (account verification, billing receipts, security and product notifications, and support requests sent from the dashboard) | Name, email address, message content | United States; EU sending region (Ireland) used where available | SCCs (Module 2) and EU-US Data Privacy Framework where applicable |
| Zoho Corporation B.V. (Netherlands) | Business email for hello@paiq.io (support and privacy requests, contact form messages, correspondence with customers) | Name, email address, business contact details, message content, including support and billing correspondence | EU (data centres in the Netherlands and Ireland); remote technical support access from India | Data processing agreement with Zoho; Standard Contractual Clauses for the remote support access from India |
Service providers, PAIQ Access
For the PAIQ Access accessibility checker (access.paiq.io) PAIQ is the data controller and processes no personal data on behalf of its customers, so these are PAIQ's own service providers, not sub-processors engaged on behalf of a Customer.
| Service provider | Purpose | Data categories | Location | Transfer mechanism |
|---|---|---|---|---|
| Stripe Payments Europe, Ltd. | Payment processing for single reports and the Agency plan | Buyer email, billing details and payment data (card data never stored by PAIQ) | Ireland (EU); Stripe group entities worldwide | No third-country transfer by PAIQ. Any transfer within the Stripe group is made by Stripe under its own terms. |
| Resend, Inc. | Delivery of unlock codes and reports by email | Recipient email address and the attached report; delivery data retained by the provider for up to 30 days | United States | SCCs, and EU-US Data Privacy Framework (with UK Extension) where applicable |
| Hostinger International Ltd. | Application hosting and server logs for access.paiq.io | IP address and connection data in server logs; scanned URLs processed transiently | Frankfurt, Germany (EU); provider established in Cyprus (EU) | EU hosting, no third-country transfer by PAIQ; the provider's own sub-processors are governed by its DPA |
3. International Data Transfers
Where PAIQ itself sends personal data to a provider outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses (Module 2, controller to processor, because PAIQ is the controller of that data) as the basis for the transfer under Chapter V of the GDPR, and on the EU-US Data Privacy Framework where the provider is certified under it. OpenAI, Anthropic and Stripe serve PAIQ through companies established in the EU, so PAIQ makes no third-country transfer to them; where they process data outside the EEA, they make that transfer themselves, under the safeguards shown in the tables above.
We assess each transfer on a case-by-case basis and, where appropriate, apply supplementary technical and organisational measures (encryption in transit, AES-256 encryption of off-site backups, access controls, data minimisation, and limited retention windows).
4. Infrastructure and Internal Tooling
The following systems are used internally by PAIQ to operate the business but are not subprocessors of personal data of our customers' end users:
- Self-hosted services on Hetzner — application database (PostgreSQL), cache (Redis), automation runner (n8n). All are hosted within our EU infrastructure and are not separate subprocessors.
- Internal collaboration tools — used by the founding team for code, documentation, and project management. These do not store customer-end-user personal data.
5. Adding or Replacing a Subprocessor
We will update this page whenever we add, replace, or remove a subprocessor that processes personal data on behalf of PAIQ customers. Customers on a Data Processing Agreement may subscribe to advance notice of changes by emailing hello@paiq.io. Where a customer reasonably objects to a new subprocessor on data protection grounds, we will work in good faith to address the concern.
6. Contact
For any questions about our subprocessors or to request a copy of our Data Processing Agreement (DPA):
hello@paiq.io
PAIQ RAAS, S.L. — NIF B27677392 — Málaga, Spain