Tellyou AI AB uses the third-party sub-processors listed below to deliver, secure and support the Tellyou Service. We engage each under a written agreement that includes the data-protection terms required by Article 28 of the GDPR and, where personal data is transferred outside the EU/EEA, the European Commission's Standard Contractual Clauses (Decision 2021/914) together with supplementary measures.

This list forms part of, and is incorporated by reference into, our Data Processing Agreement.

How to be notified of changes

We give at least 30 days' notice before adding or replacing a sub-processor that processes personal data on behalf of customers (or such shorter notice as is reasonable for an urgent security replacement). To be notified of changes, email privacy@tellyou.ai with the subject "Subscribe sub-processor updates".

Customers may object to a new sub-processor on reasonable data-protection grounds within the notice period; see the DPA for the procedure.

Infrastructure and platform

Supabase (Supabase Inc.) — primary application database, authentication, file storage and edge-function runtime. Hosts the bulk of Customer Data. Processing location: European Union (Frankfurt). Website: supabase.com. Transfer mechanism: not required for EU-region processing; EU SCCs apply where Supabase personnel outside the EU provide support.

Cloudflare, Inc. — content delivery network, DDoS protection, WAF, edge workers (Workers, R2 and KV) for the marketing site, help center and the Tellyou for Shopify application. Processing location: global edge network with primary control plane in the United States. Website: cloudflare.com. Transfer mechanism: EU SCCs; Cloudflare is certified under the EU–US Data Privacy Framework.

AI and voice providers

OpenAI (OpenAI, L.L.C. and OpenAI Ireland Ltd) — large-language-model inference, embeddings and real-time voice models used to generate chatbot responses. Inputs and outputs are transmitted to OpenAI strictly to produce a response. We contractually require that Customer inputs and outputs are not used to train OpenAI's foundation models. Processing location: United States; EU-region processing where available. Website: openai.com. Transfer mechanism: EU SCCs; OpenAI is certified under the EU–US Data Privacy Framework.

ElevenLabs, Inc. — voice synthesis and conversational-voice agent for the optional voice features of the Service. Receives the text or audio necessary to generate or transcribe voice. We contractually require that Customer inputs and outputs are not used to train ElevenLabs' foundation models. Processing location: United States. Website: elevenlabs.io. Transfer mechanism: EU SCCs.

Messaging and channel integrations

The following providers act as sub-processors only when the Customer connects the corresponding channel. They process the messages and identifiers exchanged through that channel.

Meta Platforms Ireland Ltd / Meta Platforms, Inc. — Instagram, Messenger and WhatsApp Business Platform integrations. Tellyou ingests messages, sender identifiers and related metadata via the Meta Graph API for the purpose of operating the chatbot on those channels. Processing location: Ireland (EU) and United States. Website: meta.com. Transfer mechanism: EU SCCs; Meta US is certified under the EU–US Data Privacy Framework.

Google LLC / Google Ireland Ltd — Gmail integration. When the Customer connects a Gmail account, message content and metadata are fetched via the Gmail API to enable the bot to read and reply to email. Processing location: Ireland (EU) and United States. Website: google.com. Transfer mechanism: EU SCCs; Google is certified under the EU–US Data Privacy Framework.

Shopify Inc. — Shopify integration. When the Customer installs the Tellyou app on a Shopify store, store, product and order context is fetched via the Shopify Admin API strictly to answer buyer questions. Processing location: Canada and United States. Website: shopify.com. Transfer mechanism: EU SCCs; Shopify US is certified under the EU–US Data Privacy Framework.

Billing

Stripe Payments Europe, Ltd. / Stripe, Inc. — subscription billing, payment processing and tax calculation for the Tellyou Service. Payment-card data is collected directly by Stripe and does not transit Tellyou's servers. Processing location: Ireland (EU) and United States. Website: stripe.com. Transfer mechanism: EU SCCs; Stripe US is certified under the EU–US Data Privacy Framework.

Transactional email

Sendinblue SAS (Brevo) — sending of transactional email such as account verification, password reset, notifications and billing receipts. Receives recipient email address and message content. Processing location: European Union (France). Website: brevo.com. Transfer mechanism: not required (EU processing).

Changes to this list

We maintain a version history of this page in our help-center repository so customers can verify when a sub-processor was added or removed. For any question, write to privacy@tellyou.ai.

From Sweden with