Legal
Sub-processor List
Version 1.0 · Published on 16 September 2026 · Effective from 16 September 2026
Canonical URL: https://irelia.ai/legal/subprocessors
Automation Genius By KDL, with registered office at Contrada Santa Maria Maggiore 4, 66011 Bucchianico (CH), Italy (hereinafter “Irelia”), publishes on this page the list of third parties that process personal data in the delivery of the Irelia platform.
The page is organised in two sections:
- Section 1 — Sub-processors of Workspace data. The parties that process, on behalf of Irelia and on its instructions, the data handled by the AI agents (conversations, contacts, bookings, knowledge base, logs). This section is referenced by the Irelia↔Partner DPA and by the Partner↔Client DPA: by entering into the DPA, the controller gives general authorisation for the engagement of these parties (Art. 28(2) GDPR).
- Section 2 — Recipients of data for which Irelia is the controller. The parties that receive the contractual, account and billing data of Partners, Affiliates and platform Users. This section is referenced by Irelia’s privacy notice (Art. 13(1)(e) GDPR).
The same provider may appear in both sections. The list reflects the providers actually active in production on the publication date.
Transfers of data outside the European Union
Some providers process data in the United States. For these transfers Irelia adopts the following safeguards.
Transfer mechanism. Standard contractual clauses adopted by the European Commission (Decision (EU) 2021/914), incorporated in each provider’s data processing agreement (Art. 46(2)(c) GDPR). Where the provider is certified under the EU-US Data Privacy Framework (Commission adequacy decision of 10 July 2023), the certification is indicated as an additional safeguard: its status is verified on the official register (dataprivacyframework.gov) on the publication date of each version of this list. Any invalidation of the Data Privacy Framework does not affect the standard contractual clauses mechanism.
Supplementary measures.
- Pseudonymisation before sending to language models. Direct identifying data (name, telephone number, email address) are replaced with placeholders in Irelia’s systems before the content of conversations is sent to the language model providers, and reconstituted after the reply. The free text of messages is not filtered.
- Encryption in transit (TLS 1.2 or higher) and at rest (AES-256) on all flows.
- No model training on the data processed: guaranteed by the commercial terms of each language model provider.
For providers established in and processing within the European Union, no transfer takes place.
Section 1 — Sub-processors of Workspace data
| Provider | Contracting entity | Service | Data processed and retention at the provider | Country of processing | Transfer mechanism | Contractual document |
|---|---|---|---|---|---|---|
| Amazon Web Services | Amazon Web Services EMEA SARL, Luxembourg | Compute, queue and storage infrastructure; Amazon Bedrock for running the DeepSeek models; delivery and real-time connections for the Webchat | All Workspace data in transit and in storage. For Bedrock: pseudonymised conversational content; Bedrock does not retain requests and responses, and invocation logging is disabled | United States (us-east-1 region) | Standard contractual clauses (AWS GDPR Data Processing Addendum, incorporated in the AWS Service Terms). Additional safeguard: Data Privacy Framework certification of Amazon.com, Inc. and Amazon Web Services, Inc. | AWS Service Terms · AWS GDPR Center |
| Bubble | Bubble Group, Inc., New York (USA) | Central database and dashboard application | All Workspace data; account data of Partners, Clients and Users | United States | Standard contractual clauses (Bubble Data Processing Addendum). Additional safeguard: Data Privacy Framework certification of Bubble Group, Inc. | Bubble Data Processing Addendum |
| Gupshup | Gupshup Inc., Fremont, California (USA) | WhatsApp Business Solution Provider: message routing, template management, app onboarding | Telephone number, content of WhatsApp messages, delivery metadata. Retention at Gupshup: 2 years with quarterly deletion; logs accessible to support for 7 days | United States | Standard contractual clauses (Module 3) incorporated in the Data Processing Agreement entered into between Gupshup Inc. and Irelia | Gupshup Inc. Data Processing Agreement (bilateral agreement, not public; a copy of the clauses is available as provided in the DPA) |
| OpenAI | OpenAI OpCo, LLC, San Francisco, California (USA) | Language models, embeddings, transcription of voice messages | Pseudonymised conversational content; audio of voice messages for transcription. Retention at OpenAI: up to 30 days for abuse detection, then deletion; no use for training | United States | Standard contractual clauses (OpenAI Data Processing Addendum). OpenAI does not appear to be certified under the Data Privacy Framework | OpenAI Data Processing Addendum |
| Anthropic | Anthropic, PBC, San Francisco, California (USA) | Language models | Pseudonymised conversational content. Retention at Anthropic: deletion within 30 days; up to 2 years only for content flagged for violation of the usage policies; no use for training | United States | Standard contractual clauses (Data Processing Addendum incorporated in the Commercial Terms of Service). Data Privacy Framework certification not declared | Anthropic Commercial Terms · Anthropic Data Processing Addendum |
| Google Cloud | Google Cloud Italy S.r.l., Milan | Vertex AI: Gemini models | Pseudonymised conversational content. Retention at Google: cache up to 24 hours; only prompts flagged by automated safety systems are retained for up to 30 days, in the project’s region, to verify potential abuse; no use for training | United States (us-east1 region) | Standard contractual clauses (Google Cloud Data Processing Addendum). Additional safeguard: Data Privacy Framework certification of Google LLC | Google Cloud Data Processing Addendum |
| Qdrant | Qdrant Solutions GmbH, Berlin | Vector database for semantic search over the knowledge base | Embeddings and text chunks of the Workspace knowledge base | Germany | No transfer (European Union) | Qdrant Cloud Data Processing Agreement |
| Postmark | ActiveCampaign, LLC, Chicago, Illinois (USA) | Transactional email | Email address and name of Users with an account; content of notifications (credit thresholds, acceptance receipts, alerts) | United States | Standard contractual clauses (ActiveCampaign Data Processing Addendum, which covers Postmark). Additional safeguard: Data Privacy Framework certification of ActiveCampaign, LLC | ActiveCampaign Data Processing Addendum |
Language model providers. The platform routes requests to OpenAI, Anthropic, Google Cloud or the DeepSeek models on Amazon Bedrock according to the Workspace configuration. All receive the same scope of data, pseudonymised as described above.
DeepSeek models. They are run exclusively on Amazon Web Services infrastructure (Amazon Bedrock, us-east-1 region). Hangzhou DeepSeek Artificial Intelligence Co. receives no data and is not a sub-processor.
Section 2 — Recipients of data for which Irelia is the controller
| Recipient | Role | Service | Data | Country of processing | Transfer |
|---|---|---|---|---|---|
| Stripe Payments Europe, Ltd, Dublin | Independent controller | Payments between Irelia and Partners; Stripe Connect infrastructure on which the Partner connects its own Stripe account | Partner’s payment and billing data. Clients’ data present on the Partner’s Stripe account are processed by Stripe in its direct relationship with the Partner | European Union, with intra-group transfers to Stripe, LLC (USA) | Managed by Stripe as controller (intra-group standard contractual clauses; Data Privacy Framework certification of Stripe, LLC). Stripe Privacy Policy |
| Aruba S.p.A., Bibbiena (AR), Italy | Processor | Electronic invoicing (Italian Exchange System, Sistema di Interscambio) | Partner’s personal and billing details | Italy | None |
| Amazon Web Services, Bubble, Postmark | Processors | As in Section 1 | Account and contractual data of Partners, Affiliates and Users | As in Section 1 | As in Section 1 |
Parties not included in the List
The following parties process personal data in connection with the Irelia platform but are not sub-processors of Irelia, for the reasons indicated.
| Party | Reason |
|---|---|
| Meta Platforms Ireland Ltd (WhatsApp, Instagram, Facebook Messenger) | Independent controller of the data processed on its own messaging channels, for its own purposes and in accordance with its own privacy notice. Meta’s role is described in the DPA and in the privacy notices provided to end users. |
| Services connected by the Workspace controller (e.g. Google Calendar) | Services that the Workspace controller connects to the platform with its own credentials. Irelia accesses them on the controller’s instruction; the contractual relationship with the service provider is the controller’s. |
| Payment service provider on the Partner’s account | Processes the Clients’ subscription data in its direct relationship with the Partner. It is not engaged by Irelia. |
| Banks | Receive the name and bank details of transfer beneficiaries (e.g. Affiliates) to execute the payment, as independent controllers and for their own legal obligations. |
| Hangzhou DeepSeek Artificial Intelligence Co. | Not a counterparty of Irelia: the DeepSeek models are run on Amazon Bedrock (see Section 1). |
Updates to the List
The addition or replacement of a sub-processor is published on this page with at least 60 days’ notice before the date on which the new party begins processing Workspace data, and is communicated to Partners as provided in the DPA. Within such period the controller may object on well-founded data protection grounds, in the manner and with the effects provided in the DPA. Replacements necessary for security reasons, due to the provider ceasing operations or failing to perform, or due to a measure by an authority, may take place with reduced notice.
The status of Data Privacy Framework certifications is verified at each new version.
Version history
| Version | Publication date | Effective date | Change |
|---|---|---|---|
| 1.0 | 16 September 2026 | 16 September 2026 | First publication |
For questions about this list: info@irelia.ai