Subprocessors
Paskutinis redagavimas: 2026-08-21
Informational translation. The binding version of this document is the Lithuanian one. If the two ever differ, the Lithuanian text prevails — see the language clause in §14 of the Terms. Read the Lithuanian original.
The vendors SmartChat passes data to for processing. This list forms part of the DPA — changes are announced in advance (see the section at the bottom).
Current list
| Vendor | Purpose | Data | Location | Transfer basis |
|---|---|---|---|---|
| Anthropic PBC | Generating AI answers (Claude Sonnet 4.6 and Claude Haiku 4.5) | Conversation messages, the retrieved knowledge-base excerpts | United States | SCCs (standard contractual clauses) |
| OpenAI, L.L.C. | Turning text into vectors for search (text-embedding-3-small) | Knowledge-base text, the visitor’s query text | United States | SCCs (standard contractual clauses) |
| Supabase, Inc. | Database (PostgreSQL + pgvector), authentication | All account and conversation data | EU — Frankfurt (eu-central-1) | Not needed — data stays in the EEA |
| Vercel, Inc. | Application hosting and execution | Request traffic (including conversation messages while they are processed), server logs | EU — Frankfurt (fra1) | Not needed for execution (fra1); the US parent may access data for support — SCCs |
| Upstash, Inc. | Redis — request rate limiting | IP address, tenant ID, counters | EU — Ireland (eu-west-1) | Not needed — data stays in the EEA |
| Resend (Plus Five Five, Inc.) | Outbound email | Email addresses, message content | EU — Ireland (eu-west-1) | Not needed for sending (EU region); the US company may access data for support — SCCs |
| Stripe Payments Europe, Ltd. | Subscription payments and billing | Billing contacts, payment details (we never see card numbers) | EU — Ireland | Not needed — data stays in the EEA |
| Sentry (Functional Software, Inc.) | Error monitoring (configured with sendDefaultPii: false) | Error traces, technical metadata | EU — Frankfurt (de.sentry.io) | Not needed for ingest (EU region); the US parent may access data for support — SCCs |
| Google Ireland Ltd. (Gmail API)Only if the customer enables it | Reply drafts in the customer’s own Gmail mailbox | Email content and addresses | EU / United States | SCCs (standard contractual clauses) |
| Shopify International Ltd.Only if the customer enables it | Reading store data (products, orders) | Store catalogue data, data the customer provides | EU / Canada | SCCs (standard contractual clauses) |
Why some data travels to the United States
The AI core itself is provided by US companies. Conversation messages go to Anthropic to generate the answer, and text goes to OpenAI to be turned into vectors so that knowledge-base search works. The service would not function without these transfers, so they happen continuously rather than occasionally.
The infrastructure runs in the EU: database (Frankfurt), application execution (Frankfurt), rate limiting (Ireland), error monitoring (Frankfurt), billing (Ireland). Several of these services have US parent companies that may access data for support purposes — where that is the case, the table names SCCs.
Transfer impact assessment. Transfers to the US are protected by standard contractual clauses (2021/914, Module 3). In assessing the circumstances we took into account that what is transferred is an online shopper’s question and the related knowledge-base excerpts, not special categories of data under Art. 9 GDPR; that the data travels over an encrypted channel and is not used by the providers to train models; and that the providers retain the content only briefly — OpenAI for up to 30 days for abuse monitoring. Weighing the nature, volume and retention of the data transferred, the residual risk is considered acceptable. The assessment is revisited when subprocessors or the legal landscape change.
Changes to this list
Before we start using a new subprocessor, we notify customers by email at least 30 days in advance. During that period a customer may reasonably object; if the objection cannot be resolved, the customer may cancel the subscription without penalty for the remaining paid period.
Notices are sent to the email address on the account.