Legal
Sub-processors
Last updated
This page lists the companies we use that receive personal data from Cyrano. Cyrano is run by Elevate Digital Media AB, organisation number 559416-7792, Fagerstagatan 58, 163 53 Stockholm, Sweden. Contact: support@meetcyrano.com.
1. Who is on this list
Every company below receives personal data from Cyrano so that Cyrano can work.
Those that receive personal data we handle for merchants are our sub-processors, which our Data Processing Agreement allows us to use. The others receive only the personal data we decide about ourselves, as our Privacy Policy describes.
A merchant’s own Shopify store and Zendesk or Gorgias helpdesk are not on this list: they are the merchant’s providers, under the merchant’s own agreements with them.
2. The companies
| Company | What it receives, and why | Where it processes it | If data leaves the EEA | Its data terms |
|---|---|---|---|---|
| Supabase Supabase Pte. Ltd (Singapore) | Everything in Cyrano’s database and file storage: tickets, messages, customer and order details, merchant content and accounts. The database and file storage Cyrano runs on. | London, United Kingdom (AWS eu-west-2). | EU Standard Contractual Clauses (Modules 2 and 3) with UK and Swiss terms, in Supabase’s DPA. | Supabase Data Processing Addendum |
| Vercel (hosting) Vercel Inc. | Every request to the Cyrano app and to meetcyrano.com, and their server logs; on meetcyrano.com, the count of visits, made without cookies (Vercel Web Analytics). Hosting and running the Cyrano app and meetcyrano.com, and counting visits to meetcyrano.com. | The app runs in London, United Kingdom (lhr1), and meetcyrano.com is served from Vercel’s network; Vercel’s main processing facilities are in the United States. | EU Standard Contractual Clauses and the UK transfer agreement, entered by Vercel’s DPA; Vercel also certifies under the EU-U.S. Data Privacy Framework. | Vercel Data Processing Addendum |
| Vercel Blob Vercel Inc. | Files merchants upload to their knowledge base or to draft a playbook. Storing merchants’ uploads. | Stockholm, Sweden (the Blob store’s arn1 region). | EU Standard Contractual Clauses and the UK transfer agreement, entered by Vercel’s DPA; Vercel also certifies under the EU-U.S. Data Privacy Framework. | Vercel Data Processing Addendum |
| Vercel AI Gateway Vercel Inc. | The text, photos and documents Cyrano sends to AI models, with the personal details Cyrano recognises in the text already replaced by placeholders unless the merchant switched masking off for the agent sending it: a file a shopper, the store’s team or the merchant sends goes as itself to a model that reads its kind, and otherwise as its text or a line naming it. It passes each request to one of the AI hosts below. Sending each AI request to an approved AI host. | Vercel’s network; nothing stays after the request. | EU Standard Contractual Clauses and the UK transfer agreement, entered by Vercel’s DPA; Vercel also certifies under the EU-U.S. Data Privacy Framework. | Vercel Data Processing Addendum and AI Product Terms |
| Baseten Baseten Labs, Inc. | Text for the AI models it runs, with the personal details Cyrano recognises replaced by placeholders unless the merchant switched masking off for the agent sending it — the text and names of files people send among it — and the photos and documents people send, for a model that reads them. Running the AI models behind Cyrano’s agent. | United States. | EU Standard Contractual Clauses (Modules 2 and 3) and the UK Addendum, in Baseten’s DPA. | Baseten Data Processing Addendum |
| Fireworks AI Fireworks.ai, Inc. | Text for the AI models it runs, with the personal details Cyrano recognises replaced by placeholders unless the merchant switched masking off for the agent sending it — the text and names of files people send among it — and the photos and documents people send, for a model that reads them. Running the AI models behind Cyrano’s agent. | United States. | EU Standard Contractual Clauses (Module 2) with UK and Swiss terms, in Fireworks’ DPA. | Fireworks Data Processing Addendum |
| DigitalOcean DigitalOcean, LLC | Text for the AI models it runs, with the personal details Cyrano recognises replaced by placeholders unless the merchant switched masking off for the agent sending it — the text and names of files people send among it — and the photos and documents people send, for a model that reads them. Running the AI models behind Cyrano’s agent. | Not fixed. DigitalOcean commits to no EU region for AI inference. | EU-U.S. Data Privacy Framework with its UK and Swiss extensions; EU Standard Contractual Clauses and the UK Addendum if that framework stops applying. | DigitalOcean Data Processing Agreement |
| Google Vertex AI Google Cloud (the Google entity on the Google Cloud account) | Text for Gemini and Claude models and for search embeddings, with the personal details Cyrano recognises replaced by placeholders unless the merchant switched masking off for the agent sending it — the text and names of files people send among it — and the photos and PDFs people send, for a model that reads them. Running Gemini and Claude models and making knowledge-base and playbook search embeddings. | EU and US regions for Gemini and Claude chat; the United States (us-east5) for embeddings. | An adequacy decision or an alternative transfer solution, otherwise EU Standard Contractual Clauses, under the Google Cloud DPA. | Google Cloud Data Processing Addendum |
| Google Cloud Run (Docling document reader) Google Cloud (the Google entity on the Google Cloud account) | Documents the merchant uploads to the knowledge base (PDF, Word, slides, spreadsheets, images), with their file names. Reading uploaded documents into the knowledge base with their tables kept, on a Docling service Cyrano runs in its own Google Cloud account. | United States (Google Cloud us-central1). | An adequacy decision or an alternative transfer solution, otherwise EU Standard Contractual Clauses, under the Google Cloud DPA. | Google Cloud Data Processing Addendum |
| Microsoft Azure Microsoft Corporation (Microsoft Ireland Operations Limited for the EEA, the UK and Switzerland) | Text for DeepSeek and OpenAI chat models, and for embeddings of memory notes and of questions the knowledge base could not answer, with the personal details Cyrano recognises replaced by placeholders unless the merchant switched masking off for the agent sending it — the text and names of files people send among it — the photos and PDFs people send, for an OpenAI model that reads them, and the knowledge-base quality test’s prompts. Running AI models behind Cyrano’s agent, making embeddings and grading knowledge-base search quality. | The geography of the Azure deployment; the AI Gateway does not state it. | EU-U.S. Data Privacy Framework with its UK and Swiss extensions, and EU Standard Contractual Clauses. | Microsoft Products and Services Data Protection Addendum |
| Amazon Bedrock Amazon Web Services (the AWS entity on the AWS account) | Search queries, with the personal details Cyrano recognises replaced by placeholders unless the merchant switched masking off for the agent sending it — the names of files a shopper sent among them — and the knowledge-base passages ranked against them. Ranking knowledge-base and playbook search results (Cohere Rerank 3.5). | United States (us-east-1). | EU Standard Contractual Clauses in the AWS Service Terms, applied automatically; AWS also certifies under the EU-U.S. Data Privacy Framework. | AWS Service Terms |
| Anthropic Anthropic Ireland, Limited (Anthropic, PBC outside the EEA, Switzerland and the UK) | Text for Claude models, with the personal details Cyrano recognises replaced by placeholders unless the merchant switched masking off for the agent sending it — the text and names of files people send among it — and the photos people send, for a model that reads them. Running the AI models behind Cyrano’s agent. | United States. | EU Standard Contractual Clauses (Modules 2 and 3), with UK and Swiss addenda, in Anthropic’s DPA. | Anthropic Data Processing Addendum |
| OpenAI (AI models) OpenAI OpCo, LLC (OpenAI Ireland Ltd. for EEA and Swiss customers) | Text for the AI models it runs, with the personal details Cyrano recognises replaced by placeholders unless the merchant switched masking off for the agent sending it — the text and names of files people send among it — and the photos and documents people send, for a model that reads them. Running the AI models behind Cyrano’s agent. | United States. | EU Standard Contractual Clauses or an EU adequacy decision; for UK data, the Clauses with the UK Addendum. | OpenAI Data Processing Addendum |
| Groq Groq UK Limited for customers in the EEA and Switzerland (Groq LLC elsewhere) | Text for the AI models it runs, with the personal details Cyrano recognises replaced by placeholders unless the merchant switched masking off for the agent sending it — the text and names of files people send among it — and the photos and documents people send, for a model that reads them. Running the AI models behind Cyrano’s agent. | The United States and other countries where Groq or its sub-processors operate. | EU Standard Contractual Clauses (Modules 2 and 3), with UK and Swiss terms, in Groq’s DPA. | Groq Customer Data Processing Addendum |
| Mistral AI Mistral AI (Paris, France) | Text for the AI models it runs, with the personal details Cyrano recognises replaced by placeholders unless the merchant switched masking off for the agent sending it — the text and names of files people send among it — and the photos and documents people send, for a model that reads them. Running the AI models behind Cyrano’s agent. | The European Union first; Mistral uses providers outside it only in exceptional cases. | None needed inside the EU; outside it, an adequacy decision or EU Standard Contractual Clauses, under Mistral’s DPA. | Mistral AI Data Processing Addendum |
| SpaceXSI (xAI) SpaceXAI LLC | Text for the AI models it runs, with the personal details Cyrano recognises replaced by placeholders unless the merchant switched masking off for the agent sending it — the text and names of files people send among it — and the photos and documents people send, for a model that reads them. Running the AI models behind Cyrano’s agent. | The United States, where its main data centres are, and other countries where it or its sub-processors operate. | EU Standard Contractual Clauses (Modules 2 and 3), with UK and Swiss terms, in SpaceXSI’s DPA. | SpaceXSI Data Processing Addendum |
| Meta (Model API) Meta Platforms Ireland Limited (Meta Platforms, Inc. outside the European Region) | Text for the AI models it runs, with the personal details Cyrano recognises replaced by placeholders unless the merchant switched masking off for the agent sending it — the text and names of files people send among it — and the photos and documents people send, for a model that reads them. Running the AI models behind Cyrano’s agent. | Not stated in the Model API terms. | None needed while Meta Platforms Ireland processes it in the EU; a transfer to a Meta processor outside the EU uses EU Standard Contractual Clauses (Module 2), in Meta’s processor terms. | Meta Global Processor Terms, with their European Region Terms |
| Nebius Token Factory Nebius B.V. (Netherlands) | Text for the AI models it runs, with the personal details Cyrano recognises replaced by placeholders unless the merchant switched masking off for the agent sending it — the text and names of files people send among it — and the photos and documents people send, for a model that reads them. Running the AI models behind Cyrano’s agent. | Not fixed: Nebius places each model in France, Iceland, Finland, the United Kingdom, Israel, the United States or Canada. | None needed inside the EEA; an EU adequacy decision for the United Kingdom and Israel; EU Standard Contractual Clauses, in Nebius’s DPA, for the United States and Canada. | Nebius Data Processing Agreement |
| Modal Modal Labs, Inc. | Text for the AI models it runs, with the personal details Cyrano recognises replaced by placeholders unless the merchant switched masking off for the agent sending it — the text and names of files people send among it — and the photos and documents people send, for a model that reads them. Running the AI models behind Cyrano’s agent. | Not fixed: requests enter through the United States and run anywhere in Modal’s global compute pool. | EU Standard Contractual Clauses (Modules 2 and 3), with UK and Swiss terms, in Modal’s DPA. | Modal Data Processing Addendum |
| OpenAI (moderation) OpenAI OpCo, LLC (OpenAI Ireland Ltd. for EEA and Swiss customers) | Each reply draft, with the personal details Cyrano recognises replaced by placeholders. Checking each outgoing reply for harmful content before it is sent. | United States. | EU Standard Contractual Clauses or an EU adequacy decision; for UK data, the Clauses with the UK Addendum. | OpenAI Data Processing Addendum |
| Lakera Guard Lakera, part of Check Point Software Technologies (which entity holds Cyrano’s account is not confirmed) | Each incoming shopper message, with the personal details Cyrano recognises replaced by placeholders. Screening incoming messages for attempts to manipulate the agent. | AWS in the EU (Ireland, Germany), the United States and Singapore. | EU Standard Contractual Clauses (Module 3) and the UK Addendum in Check Point’s customer DPA, once it covers Cyrano’s account. | Check Point customer DPA (not yet in force for Cyrano) |
| TypeSafe TypeSafe AI, Inc. | The first message of each new helpdesk conversation, and a later one while it is held as spam, with its subject, with the personal details Cyrano recognises replaced by placeholders. Reading each new message before the agent starts: whether it is spam, which language it is in, and who wrote it. | United States. | EU Standard Contractual Clauses (Module 2) with the UK Addendum, in TypeSafe’s Data Processing Addendum, under Irish law. | TypeSafe Data Processing Addendum (not yet in force for Cyrano) |
| ParcelsApp The operator of parcelsapp.com (its privacy policy does not name a company) | Tracking numbers, with the order’s destination country. Finding where a shopper’s parcel is. | Not stated. The server Cyrano sends to is in London, United Kingdom. | None named. Its privacy policy names no transfer safeguard. | None published |
| 17TRACK VASTAR SINGAPORE TECHNOLOGY PTE. LTD. | Tracking numbers, when ParcelsApp cannot answer. Finding where a shopper’s parcel is. | Outside the EU, wherever 17TRACK’s staff and sub-processors work. | EU Standard Contractual Clauses, entered with the service agreement, in 17TRACK’s DPA. | 17TRACK Online Data Processing Agreement |
| Inngest Inngest Inc. | Background job data: record ids, reply text on its way to a shopper, merchants’ feedback on drafts, and knowledge-base content being read in. A reply can name the shopper and their order. Running Cyrano’s background jobs. | United States (AWS). | None in place until the signed DPA is. | Inngest signed Data Processing Agreement (paid plans, on request) (not yet in force for Cyrano) |
| Sentry Functional Software, Inc. d/b/a Sentry | Error reports from the app, which can include personal data. Finding and fixing errors in the app. | Germany (Sentry’s EU region). | EU-U.S. Data Privacy Framework, with EU Standard Contractual Clauses (Modules 2 and 3) as fallback, in Sentry’s DPA. | Sentry Data Processing Addendum |
| Reality Defender Reality Defender, Inc. | Photos shoppers send as evidence, to check whether they were faked. Detecting manipulated images. | Not stated. | EU Standard Contractual Clauses (Module 2) and the UK transfer agreement, treated as signed by its DPA; its privacy policy also states EU-U.S. Data Privacy Framework compliance. | Reality Defender Data Processing Addendum |
| Clerk Clerk, Inc. | Merchant users’ sign-in details, and the email addresses visitors leave for early access. Signing merchant users in to Cyrano, and keeping the early-access list. | Google Cloud and Cloudflare data centres, wherever Clerk or its sub-processors have facilities. | EU-U.S. Data Privacy Framework with its UK and Swiss extensions, and EU Standard Contractual Clauses as fallback. | Clerk Data Processing Addendum |
| Twilio Verify Twilio Inc. and its contracting affiliate under the account agreement | The shopper’s phone number, a one-time code, language, store name and verification outcome. Delivering a code to confirm control of the buyer’s phone. | Twilio and its sub-processors’ processing locations, including outside the EEA; no EEA-only location is configured. | Data Privacy Framework, Twilio Binding Corporate Rules, or EU Standard Contractual Clauses with UK and Swiss terms, as applicable under the DPA. | Twilio Data Protection Addendum |
| Resend Plus Five Five, Inc. (Resend) | Emails Cyrano sends: alerts to merchant users, ownership codes (recipient email, store name and one-time code), and a shopper’s order confirmation (name, email, shipping address and order details) when the agent re-sends it. Sending emails to merchant users, re-sending order confirmations, and delivering shopper ownership codes. | United States. | EU Standard Contractual Clauses with UK and Swiss terms; Resend also complies with the EU-U.S. Data Privacy Framework. | Resend Data Processing Addendum |
| Firecrawl SideGuide Technologies, Inc. d/b/a Firecrawl | Pages of the merchant’s own website, when the merchant adds it to the knowledge base. Reading the merchant’s website into the knowledge base. | United States (Supabase on AWS us-east-1, and Google Cloud us-east4). | EU Standard Contractual Clauses (Module Two), with UK and Swiss terms, in the signed DPA; the supervisory authority is Sweden’s IMY. | Firecrawl Data Processing Addendum (EU), signed by both sides on 2026-09-29 |
3. Changes to this list
How we tell merchants before a new sub-processor receives their data, and how they can object, is in section 5 of our Data Processing Agreement.