Sub-processors
The current list of sub-processors who process personal data on our behalf, with the country of processing and the legal mechanism for each transfer.
We use a small number of vetted third parties to operate the service. Each is bound by a written data-processing agreement (DPA) that restricts their use of customer data to what we have instructed. This page is the definitive list. Our privacy policy summarises this list and tells you when and why your data reaches each of these parties.
| Sub-processor | Service | Data categories | Country | Transfer mechanism | DPA |
|---|---|---|---|---|---|
| AWS UK Limited | Hosting, compute, database (Aurora PostgreSQL Serverless v2), object storage (S3), and audit logging for the customer-facing service. Authentication and transactional email on AWS are planned for a later phase. | Customer accounts, OAuth refresh tokens (envelope-encrypted), compiled context, ledger entries, audit logs - all customer personal data | United Kingdom (eu-west-2 / London region) | None required (UK contracting entity, UK region) | AWS GDPR DPA, auto-incorporated into the AWS Service Terms |
| Anthropic, PBC | Large-language-model API used by our orchestrator and specialist agents (Claude Opus, Sonnet, Haiku) | Customer business spec, ad-account snapshots, site content - transient processing only via Zero Data Retention | United States | EU-US Data Privacy Framework + UK extension; Zero Data Retention enabled so prompts and outputs are not retained beyond the immediate API call | Anthropic DPA |
| Cloudflare Inc | Domain registrar, authoritative DNS for adoptima.ai, and CDN edge for static assets |
Domain registration metadata; DNS records; site-visitor IPs in transit (no persistent storage of visitor data by us) | United States | EU-US Data Privacy Framework + UK extension | Cloudflare DPA |
| GitHub Inc (Microsoft) | Source code repository and CI (GitHub Actions); lead store for the marketing-site funnel - prospect submissions are committed as one markdown file per lead into our private business-compiler repository | Prospect personal data: name, email, website URL, monthly ad-spend band, self-reported answers to the audit questionnaire, the generated audit, and IP address (for legitimate-interest abuse prevention) | United States | EU-US Data Privacy Framework + UK extension | GitHub DPA (auto-incorporated) |
| Telegram FZ-LLC | New-lead alert channel - when a prospect submits the audit or contact form, a short summary is posted to our internal operations group via the Telegram Bot API | Lead summary in transit: name, email, monthly ad-spend band, platforms, goal. No persistent storage by us; Telegram retains the message in the destination group. | United Arab Emirates (Dubai) | Standard Contractual Clauses + UK addendum, accepted via the Telegram Bot API Terms | Telegram Bot API Terms |
| Stripe Payments Europe Ltd | Subscription billing and one-time charges | Customer billing contact, payment method (held by Stripe, not by Ad Optima) | Ireland | None required (EU entity) | Stripe DPA |
The marketing site at adoptima.ai and its lead funnel run on the parties below. These remain in scope for the lead-funnel flow only - not for the customer-facing product, which runs on the active sub-processors above. They will be reviewed as the product reaches general availability.
| Sub-processor | Service (transitional only) | Data categories | Country |
|---|---|---|---|
| Vercel Inc | Marketing-site hosting (adoptima.ai) and lead-funnel serverless functions |
Site-visitor IPs and request logs in transit; lead-form submissions in transit | EU regions (functions pinned to lhr1 / London); global edge for static assets |
| Resend Inc | Transactional email for new-lead notifications (a second alert channel alongside Telegram) | Recipient address and email body (lead summary) | EU region (eu-west-1 / Ireland); sending domain send.adoptima.ai |
The following sub-processors are engaged only when the customer opts into a feature that requires them. They are not active on every customer's account by default.
| Sub-processor | Service | Triggered by |
|---|---|---|
| Slack Technologies LLC | Briefing delivery to a customer's Slack workspace | Customer enables Slack briefing at the Enterprise tier |
Customers are notified of material changes (a new sub-processor, a removed sub-processor, or a change of country of processing) at least 30 days before the change takes effect, via the email address on file. Continued use of the service after the notice period constitutes acceptance of the change. Customers who object to a specific sub-processor change have the right to terminate their subscription before the change takes effect; we will refund any pre-paid period that falls after the change date.
The following are not Ad Optima sub-processors because the data flows directly between the customer and the third party (the customer holds the controller relationship):
For any question about a specific sub-processor, transfer mechanism, or DPA, email privacy@adoptima.ai and a real human will reply.
This page is referenced from our privacy policy and our terms of service. The privacy policy describes when and why your data reaches each of these parties; this page is the operational list.