PAIQ RAAS, S.L. ("pAIq", "we", "us", or "our") engages a small number of carefully selected third-party providers ("subprocessors") that process personal data on our behalf to operate the pAIq service. This page lists every active subprocessor, the purpose of processing, the location of processing, and the legal mechanism we rely on for any transfer of data outside the European Economic Area.
This list is maintained in line with our obligations under Article 28 GDPR and the transparency requirements of our Privacy Policy. We update this page whenever we add, replace, or remove a subprocessor.
1. Product Subprocessors
These providers process personal data of pAIq account holders and Instagram message senders as part of delivering the core service.
| Subprocessor | Purpose | Data categories | Location | Transfer mechanism |
|---|---|---|---|---|
| Hetzner Online GmbH | Cloud hosting and infrastructure | All account, billing, message, and log data | Germany (EU) | Within EU — no transfer mechanism required |
| Stripe Payments Europe, Ltd. | Subscription billing and payment processing | Name, email, billing address, payment tokens (card numbers are not stored by pAIq) | Ireland (EU); processing may extend to United States | EU processing primary; SCCs (Module 2) for any US transfer |
| Meta Platforms Ireland, Ltd. | Instagram Graph API — reading and sending direct messages on behalf of the account holder | Instagram account identifiers, DM content, sender identifiers | Ireland (EU); Meta operates global infrastructure | SCCs (Module 2) and EU–US Data Privacy Framework where applicable |
| Anthropic, PBC | AI inference (Claude) used to draft replies to incoming DMs | DM content sent transiently via API for the purpose of generating a reply; no persistent storage by pAIq within Anthropic | United States | SCCs (Module 2). Customer data is not used to train Anthropic models. |
2. Operational Subprocessors
These providers process personal data collected through our website and marketing channels — for example, contact form submissions, conversations with our website assistant, and lead intake. They do not process Instagram DM data.
| Subprocessor | Purpose | Data categories | Location | Transfer mechanism |
|---|---|---|---|---|
| Millis AI | Voice agent powering the website assistant ("Neo") | Voice and text transcripts, contact details voluntarily provided during a conversation | United States | SCCs (Module 2) |
| Airtable, Inc. | Lead capture and CRM for website conversations | Name, email, conversation summary, lead status | United States | SCCs (Module 2) |
| Telegram FZ-LLC | Operator notifications for human-handover events from the website assistant | Lead summary and conversation excerpt | United Arab Emirates / global | Standard Contractual Clauses or equivalent safeguards |
| Resend, Inc. | Transactional email delivery (account verification, billing receipts, security and product notifications) | Name, email address, message content | United States; EU sending region (Ireland) used where available | SCCs (Module 2) and EU–US Data Privacy Framework where applicable |
3. International Data Transfers
Where a subprocessor is located outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses (SCCs, Module 2 — Controller to Processor) as the lawful basis for transfer under Chapter V of the GDPR. Where the relevant US-based provider is certified under the EU–US Data Privacy Framework, that framework is also relied upon.
We assess each transfer on a case-by-case basis and, where appropriate, apply supplementary technical and organisational measures (encryption in transit and at rest, access controls, data minimisation, and short retention windows for transient processing).
4. Infrastructure and Internal Tooling
The following systems are used internally by pAIq to operate the business but are not subprocessors of personal data of our customers' end users:
- Self-hosted services on Hetzner — application database (PostgreSQL), cache (Redis), automation runner (n8n). All are hosted within our EU infrastructure and are not separate subprocessors.
- Internal collaboration tools — used by the founding team for code, documentation, and project management. These do not store customer-end-user personal data.
5. Adding or Replacing a Subprocessor
We will update this page whenever we add, replace, or remove a subprocessor that processes personal data on behalf of pAIq customers. Customers on a Data Processing Agreement may subscribe to advance notice of changes by emailing hello@paiq.io. Where a customer reasonably objects to a new subprocessor on data protection grounds, we will work in good faith to address the concern.
6. Contact
For any questions about our subprocessors or to request a copy of our Data Processing Agreement (DPA):
hello@paiq.io
PAIQ RAAS, S.L. — NIF B27677392 — Málaga, Spain