Subprocessors
Last updated: April 20, 2026
Chattypie engages a small, deliberate set of third-party providers to help operate the Service. These providers, our "subprocessors", process personal data only on our instructions and under contractual commitments to protect that data. This page lists the current set.
We will update this page and notify paying customers by email at least 30 days before adding a new subprocessor that processes personal data, so you have an opportunity to object.
Questions or objections: [email protected].
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Zoho Mail | Platform transactional email (moderator invites, system notices) sent from Chattypie's own address | Recipient email addresses, invite/system message content | European Union / India (varies by data center) |
| Clerk | User authentication, session management, and OAuth | Email addresses, names, authentication events, session tokens | United States |
| Stripe | Payment processing and subscription billing | Billing names, email addresses, payment method tokens (full card numbers remain with Stripe) | United States |
| OpenAI | AI features (AI agent, suggested replies, reply rewriting, summaries) when enabled in a workspace | Conversation content and related context sent to the model at inference time | United States |
| Neon | Primary application database (PostgreSQL) | All persisted customer records: users, workspaces, conversations, messages, contacts, settings | United States / European Union (varies by project) |
| Cloudflare | Edge network: DDoS protection, DNS, TLS termination, bot management, CDN, GeoIP-based regional cookie consent. Object storage (R2) for file attachments. | Request metadata (IP, user agent, country derived from IP), uploaded files and media | Global |
| PostHog | Product analytics and session replay (usage analysis, debugging, UX improvement). Activated only with consent in regions where consent is legally required. | Page views, click events, session recordings (with sensitive content masked), Clerk user ID + email + name (for authenticated users), approximate country derived from IP | European Union (Frankfurt) |
| Cloudflare EmailPublic beta | Transactional email delivery (verification codes, notifications) | Recipient email addresses and email content | Global |
| Hetzner | Application compute for the backend and frontend. Stateless, with no customer data persisted to these servers | Transient request and response data only | European Union |
| 100ms | Voice and video calling infrastructure (when a call is placed) | Call signaling data, participant identifiers, media streams during the call | Global |
Related documents
- Privacy Policy covers how we handle personal data end to end
- Data Processing Agreement (DPA) sets the contract terms governing our processing of your customers' personal data
- Security covers encryption, access controls, and the list of gaps we are honest about