Subprocessors and data processing
For some services, we use providers that process personal data. Here, we explain their roles and how we use their services. The providers involved in your assignment depend on the agreed setup.
Updated 11 September 2026 · version 2
What role does a provider have?
When we process personal data for a business customer’s automation, we follow the agreed instructions. Providers we engage for that processing may be subprocessors. For our own website, enquiries and administration, we determine how and why personal data is processed. These two situations have different arrangements.
For your assignment
The data processing agreement and its accompanying list determine which providers are used for your assignment. They should identify the specific service, purpose, data, locations and applicable safeguards. A provider you contract directly may form part of your own processing chain. The services below therefore do not automatically apply to every customer.
Providers for our website and business operations
Scroll sideways to view all columns.
| Provider and service | Purpose | Application | Role and scope |
|---|---|---|---|
| Contabo — hosting in Germany | Hosting our server environment. | The website and data held in the relevant hosted environment. | Our website and server environment; customer processing only where agreed for the assignment. |
| Contabo — backups | Storage of recovery copies. | The data included in the relevant backup. | Recovery of our environment; customer data backups only as agreed for the assignment. |
| Hetzner — backups | External storage of recovery copies. | The data included in the relevant backup. | Recovery of our environment; customer data backups only as agreed for the assignment. |
| Cloudflare — website security | Protecting and handling website traffic, including checks against misuse. | Technical visitor and request data; depending on the service, also request content. | Our own website and its security. |
| Zoho One — CRM and calendar (EU environment) | Recording and following up business contacts and enquiries, including agreed calendar and appointment management. | Contact details, enquiry content, follow-up activities and, where used, the date, time and description of appointments. | Our own enquiries, business contacts, calendar and customer administration. |
| Google Drive | Document storage and collaboration. | Files we store or share in Google Drive for those activities. | Our business operations; processing for a customer only as agreed for the assignment. |
| OpenAI — API and ChatGPT | AI assistance with our work. | Input and files sent to the relevant service for a specific action. | Our business operations; AI processing for a customer is agreed separately. |
| Anthropic — API and Claude | AI assistance with our work. | Input and files sent to the relevant service for a specific action. | Our business operations; AI processing for a customer is agreed separately. |
Local files and self-hosting
We also work with local files on our own equipment and software on managed servers. An own storage drive is not an external provider. Self-hosted software such as n8n does not automatically make the software developer a recipient of all workflow data. Connected services, support and any diagnostics have their own data flows.
AI services and data
When using an AI service, input and files may be sent to that service. Processing can therefore take place with an external provider even when we work from our own equipment. Which data is stored and for how long depends on the service, account terms and settings. For customer data, we follow the agreed setup and instructions.
Locations and arrangements
For our own hosting, we use Contabo in Germany. For our business CRM and calendar service, we use Zoho One in its EU environment. EU storage at Zoho does not fully exclude support access from outside the EEA; transfers and safeguards are recorded per service and assignment. For customer assignments, the location and transfer arrangements in the data processing agreement and its accompanying list apply. The main server’s location does not automatically describe the locations of every connected service or support team. Ask us which specific arrangements apply to your assignment.
Changes to the provider chain
When adding or replacing a subprocessor, we follow the notification and objection procedure in the applicable data processing agreement. Our published data processing agreement specifies an objection period of 14 days after notification. Updating this webpage does not replace notification to affected customers.
Frequently asked questions
Do all listed providers receive my data?
No. This depends on the service used and the arrangements for your assignment.
Does self-hosted mean that no external processing takes place?
Not always. External integrations, AI services, security or support may form part of the setup.
Does API use mean there are no logs?
No. Storage and logging depend on the product, settings and working practices. Files or logs may also be created locally.
How do I object to a new subprocessor?
Contact us with a specific explanation of your data protection concern. The procedure and timeframe are set out in your data processing agreement and the change notice.
Questions about your data
Would you like to know which providers are involved in your assignment? Email info@aiagentcycle.com and identify your assignment. For our own processing, please also read the privacy policy.