ChatME — Sub-processor list
Version: 1.7 · Last reviewed: 2026-10-11
Controller (us): ChatMe OÜ · Reg. 17391989 · VAT EE102933761 · Järvevana tee 9, Tallinn, 11314, Estonia · privacy@chatme.es
This document lists every third party that processes personal data on our behalf when you use ChatME. Each entry shows: what they do, what data they receive, where they process it, and the legal basis for any transfer outside the EEA.
If you are a ChatME customer (the data controller for your end-users' data), you have the right under your DPA with us to know who our sub-processors are and to object to changes. We will give 30 days' notice via email and an updated version of this page before adding any new sub-processor.
How to read this list
- Service: the vendor + what they do for ChatME.
- Data processed: the specific personal data they touch.
- Region: where the data is physically processed.
- Transfer mechanism: how data lawfully leaves the EEA (when it does). Either adequacy decision, Standard Contractual Clauses (SCCs), or n/a (data stays in EEA).
- DPA / safeguards: link to the vendor's signed Data Processing Addendum.
- Role: sub-processor (acts on our instructions and receives data a customer controls — their end-users' or visitors' data); ChatME's own processor (acts on our instructions, but only on data ChatME itself controls — account holders and people signing up — so it is not a sub-processor under the customer DPA); or joint or independent controller (acts on its own).
1 · Supabase
|
|
| Service |
Managed Postgres database + Auth + Storage. Hosts every row of customer + visitor data. |
| Data processed |
Owner account info (email, hashed password, full name, business name, locale, plan), chatbot configuration, knowledge base content + embeddings, visitor conversations, form submissions, link clicks, usage logs, audit logs, Instagram OAuth tokens, and — when an owner connects an online store — the store's address and name and its API credential, encrypted (AES-256-GCM). |
| Region |
EU — eu-west-1 (Dublin, Ireland) |
| Transfer mechanism |
n/a (data stays in EEA) |
| DPA |
supabase.com/legal/dpa |
| Role |
Sub-processor |
| Vendor |
Supabase, Inc., 970 Toa Payoh North, #07-04, Singapore 318992 (US/EU operations via subsidiaries) |
| Notes |
All data encrypted at rest (AES-256) and in transit (TLS 1.2+). RLS enforced at the database level. |
2 · Anthropic
|
|
| Service |
LLM inference for chatbot conversations. We call claude-haiku-4-5 per visitor message; assistants connected to a restaurant booking system use claude-sonnet-5 (and, where enabled, an automatic reply check on the same model). |
| Data processed |
The chatbot's system prompt (your custom instructions + knowledge-base chunks retrieved via RAG) and the visitor's current message + recent turn history (last ~20 messages). This may include PII the visitor pastes (name, email, phone, free-text). When the owner has connected an online store, also what the store returned for that turn, and only after the visitor's order number, email and last name matched: the order's status, date, items (name, quantity, price), total and currency, shipping method, carrier and tracking number/link (a tracking link can carry the destination postcode and country); or, for live stock, product names, references, links and availability. |
| Region |
United States (Anthropic's US-East datacenters) |
| Transfer mechanism |
Standard Contractual Clauses (SCCs), Module 3 (processor → processor). |
| DPA |
anthropic.com/legal/commercial-terms — Commercial Terms include the DPA by reference |
| Role |
Sub-processor |
| Vendor |
Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA |
| Notes |
Anthropic's commercial terms guarantee: no training on customer data, no human review of inputs/outputs, 30-day data retention for abuse monitoring then deletion. |
3 · OpenAI
|
|
| Service |
Text embeddings for RAG (Retrieval-Augmented Generation). Model: text-embedding-3-small (1536 dims). |
| Data processed |
(a) Visitor message text, embedded per chat turn for vector search against your knowledge base. (b) Your knowledge-source content (web pages + uploaded documents), embedded once when added to the knowledge base. |
| Region |
United States |
| Transfer mechanism |
Standard Contractual Clauses (SCCs), Module 3 |
| DPA |
openai.com/policies/data-processing-addendum |
| Role |
Sub-processor |
| Vendor |
OpenAI, L.L.C., 3180 18th Street, San Francisco, CA 94110, USA |
| Notes |
API tier (not ChatGPT): no training on inputs, no human review by default, 30-day retention for abuse monitoring. |
4 · Resend
|
|
| Service |
Transactional email delivery — Welcome / Trial-ending / Welcome-to-paid / Payment-failed / Canceled emails, Supabase auth emails (confirm, reset, magic link), and form-submission notifications to chatbot owners. |
| Data processed |
Recipient email address, sender info, email subject + body. Body content may include: visitor name, business name, billing amount, plan name, form-submission field values (name / email / phone / message), one-time auth links. |
| Region |
United States (primary), with global delivery infrastructure |
| Transfer mechanism |
Standard Contractual Clauses (SCCs), Module 3 |
| DPA |
resend.com/legal/dpa |
| Role |
Sub-processor |
| Vendor |
Resend, Inc., 2261 Market Street #4790, San Francisco, CA 94114, USA |
| Notes |
Emails are stored at Resend for 30 days for delivery diagnostics, then deleted. |
5 · Stripe
|
|
| Service |
Subscription billing, payment processing, customer portal. Used only by ChatME owners (paying customers), never end-user visitors. |
| Data processed |
Owner email + name, billing address, VAT/NIF, payment method token (we never see the actual card number — it goes Stripe-direct via Stripe Elements / Checkout). Subscription state mirrored back to our DB via webhooks. |
| Region |
EU — Stripe Payments Europe, Ltd. (Ireland) is the contracting Stripe entity for EU customers |
| Transfer mechanism |
Primary data resides in EU. Some operational data may be processed in the US under SCCs. |
| DPA |
stripe.com/legal/dpa |
| Role |
Joint controller for payment-related data (Stripe sets its own retention/anti-fraud rules per PCI-DSS); ChatME's own processor for everything else (it only receives account holders' data, never data a customer controls) |
| Vendor |
Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland |
| Notes |
Stripe is PCI-DSS Level 1 certified. ChatME is out-of-scope for PCI because we never receive cardholder data. |
6 · Vercel
|
|
| Service |
Application + marketing-site hosting + CDN + Edge functions. Every HTTP request to app.chatme.es and chatme.es, and every widget script load, transits Vercel. |
| Data processed |
HTTP request metadata (IP address, user agent, referrer, request body) and response payloads — which includes everything else in this list during normal app operation. |
| Region |
Vercel's edge network is global; serverless functions for ChatME are pinned to fra1 (Frankfurt, EU) via vercel.json. Edge cache served from the nearest PoP. Logs are processed in the US. |
| Transfer mechanism |
Standard Contractual Clauses (SCCs), Module 3 — for log processing in the US. |
| DPA |
vercel.com/legal/dpa |
| Role |
Sub-processor |
| Vendor |
Vercel, Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA |
| Notes |
Vercel logs requests for 30 days for debugging, then deletes. |
7 · Google
|
|
| Service |
Google Calendar API — only when a ChatME owner connects their own Google Calendar to enable chatbot appointment booking (optional feature). |
| Data processed |
The owner's primary-calendar free/busy ranges (read) and new appointment events we create on their behalf. We never read event titles, descriptions, attendees or content. OAuth access/refresh tokens, stored encrypted (AES-256-GCM). |
| Region |
United States |
| Transfer mechanism |
Standard Contractual Clauses (SCCs), Module 3 |
| DPA |
cloud.google.com/terms/data-processing-addendum |
| Role |
Sub-processor (client-authorized integration). The calendar data belongs to the owner (controller-side); the owner connects and disconnects it themselves. |
| Vendor |
Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (Google LLC, USA, for processing) |
| Notes |
Use of Google data adheres to the Google API Services User Data Policy, including Limited Use. Tokens are deleted when the owner disconnects the calendar. |
8 · Meta Platforms (Instagram, WhatsApp & Facebook Messenger messaging — only if connected)
|
|
| Service |
Instagram DM, WhatsApp Business and Facebook Messenger (Page) messaging channels. Active only if a ChatME owner connects their Instagram/WhatsApp account or Facebook Page so the chatbot can reply on those channels. |
| Data processed |
Visitor messages sent via Instagram/WhatsApp/Messenger, the sender's platform ID, and the messaging access tokens (stored encrypted) needed to receive and reply. |
| Region |
United States (with global infrastructure) |
| Transfer mechanism |
Standard Contractual Clauses (SCCs), Module 3 |
| DPA |
facebook.com/legal/terms/dataprocessing |
| Role |
Sub-processor for the messaging relay; Meta is an independent controller of its own platform data. |
| Vendor |
Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland |
| Notes |
The visitor chose to message the business on Meta's platform, so Meta's own policies also apply there. ChatME only processes the message to generate the chatbot's reply. |
9 · Google Analytics & Google Ads (marketing site — only with consent)
|
|
| Service |
Traffic analytics (Google Analytics 4) and advertising/conversion measurement + remarketing (Google Ads) on our public marketing site (chatme.es only — not the app or the widget), loaded via Google Tag Manager. Activated only after the visitor consents (Google Consent Mode v2; denied by default). |
| Data processed |
Pseudonymous cookie identifiers (_ga, _gcl_au), IP address (shortened by GA before storage), page URLs, referrer, device/browser, and ad-interaction / conversion events. No account credentials or chatbot/visitor conversation data. |
| Region |
United States (Google Ireland Ltd. is the EU contracting entity) |
| Transfer mechanism |
Standard Contractual Clauses (SCCs) — Google Ads Data Processing Terms |
| DPA |
business.safety.google/adsprocessorterms |
| Role |
Processor for GA4 analytics; joint controller for Google Ads measurement |
| Vendor |
Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland |
| Notes |
In the default (no-consent) state, Consent Mode sends cookieless pings only — no cookies, no identifiers. Cookies (_ga, _ga_<ID>, _gcl_au) are written only after opt-in. See the Cookie Policy §3.1. |
10 · Jobber (field-service CRM — only if connected)
|
|
| Service |
Jobber GraphQL API — only when a ChatME owner connects their own Jobber account to their chatbot (optional feature, from the dashboard or from Jobber's App Marketplace). |
| Data processed |
What a visitor types when asking for a quote or a callback (name, email and/or phone, and what they need), written into the owner's Jobber account as a client + request (lead source "ChatME" on new clients; an existing client with the same email — or phone, when no email is given — is reused, not duplicated). For appointment self-service: the email and phone a visitor gives, matched against the owner's Jobber clients (read) to verify them, and reschedules/cancellations of that verified client's own appointments (write). OAuth access/refresh tokens, stored encrypted (AES-256-GCM). |
| Region |
Canada / United States |
| Transfer mechanism |
Standard Contractual Clauses (SCCs) / EU adequacy decision for Canada, per Jobber's terms |
| DPA |
getjobber.com/privacy-policy · getjobber.com/terms-of-service |
| Role |
Sub-processor (client-authorized integration). The data written to Jobber lives in the owner's own Jobber account (controller-side); the owner connects and disconnects it themselves, from either side. |
| Vendor |
Jobber Software Inc. (Octopusapp Inc.), Edmonton, Alberta, Canada |
| Notes |
Jobber is the source of truth for that data. ChatME keeps a backup record of each write the assistant made there (see the privacy policy's retention table: 365 days, then anonymised). Tokens are deleted when the owner disconnects — from the dashboard (we also notify Jobber) or from Jobber's marketplace (Jobber notifies us). |
11 · Let's Book (boat-rental booking software — only if connected)
|
|
| Service |
Let's Book REST API + webhooks — only when a ChatME owner connects their own Let's Book account to their chatbot (optional feature; the owner creates an API key in their Let's Book dashboard and pastes it into ChatME). |
| Data processed |
What a visitor types when reserving a boat (first and last name, email; phone and preferred language if given; party size, dock, boat model, pickup and return times), written into the owner's Let's Book account as a customer + a booking held as draft (partner code "chatme"; an existing customer with the same email is reused, not duplicated). Let's Book itself emails the visitor its confirmation with its own payment link — ChatME never handles payments. For booking self-service: the booking reference and email a visitor gives (on WhatsApp, the sender's number can stand in), matched against the owner's Let's Book customers and bookings (read) to verify them and show only their own booking; a note on that booking with their change/cancel request (write); and — only when the owner enables it in ChatME — a reschedule or cancellation of that verified customer's own booking (write). We also read the owner's catalogue (docks, boat models, add-ons and prices) and availability, which is business data, not personal data. Webhooks from Let's Book (booking, trip, customer and product events) keep ChatME's backup record current. The API key, stored encrypted (AES-256-GCM). |
| Region |
EU — Let's Book states that its data is stored in a European data centre; the specific country/provider is not published (to be confirmed with Let's Book) |
| Transfer mechanism |
n/a (data stays in EEA), per Let's Book's own statement. Let's Book's terms allow processing outside the EEA only where an adequate level of protection applies (adequacy decision / SCCs). |
| DPA |
lets-book.com/general-terms-and-conditions (includes its processor terms) · lets-book.com/privacy-and-cookie-statement |
| Role |
Sub-processor (client-authorized integration). The data written to Let's Book lives in the owner's own Let's Book account (controller-side); the owner connects and disconnects it themselves. |
| Vendor |
Let's Book B.V., Planciusstraat 28-H, 1013 MH Amsterdam, Netherlands (KvK 62995340) |
| Notes |
Let's Book is the source of truth for that data. ChatME keeps a backup record of each booking the assistant made or changed there, updated from Let's Book's webhooks (see the privacy policy's retention table: 365 days, then anonymised; when Let's Book reports a customer as anonymised, we anonymise our matching rows too). Let's Book API keys have no scopes (they grant full access to the owner's Let's Book organisation), so we recommend a dedicated key named "ChatME" that the owner can revoke at any time. The key is deleted when the owner disconnects, and so is the webhook subscription we registered (best-effort: if the key was already revoked, the owner removes the webhook in Let's Book). Vendor technical contact: tech@lets-book.com. |
12 · Restoo (restaurant booking system — only if connected)
|
|
| Service |
Restoo Booking Channel API + webhooks — only when a ChatME owner connects their own Restoo account to their chatbot (optional feature; the owner enters their Restoo account id and the partner API key Restoo issues for that venue). |
| Data processed |
What a visitor types when booking a table (name; email and phone — on WhatsApp, the number they write from, with the email optional; language; party size incl. children; date and time; dining area; special requests, allergies and special occasion if given), written into the owner's Restoo account as a customer + a booking. Just before booking, the visitor's phone number is looked up in the owner's Restoo (that record's email and marketing consent are read, not kept): outside WhatsApp, so as not to overwrite another customer's record — when the number is on a record with another email or none (or on several, or cannot be checked), the booking goes with the name and email only, and ChatME keeps the number in its own record to verify the visitor later; it also goes without the number when that number already holds a booking that day in the same service that isn't cancelled, declined or a no-show, when that day's bookings under it (read, not kept) cannot be read, or for an early-hours booking asked for after midnight; on WhatsApp, where the booking always carries the sender's number and updates their record, to keep that record's marketing consent and to surface a duplicate booking or a restaurant ban. Restoo itself sends the visitor every notification (confirmation, reminders) and, where the venue requires a card guarantee or prepayment, collects it on its own secure page — ChatME never handles or sees payment data. For booking self-service, outside WhatsApp: the email, phone number, day and time a visitor gives, which must all match one booking — the email and phone against ChatME's own record for bookings made through the chat, against the customer record in the owner's Restoo for others, and the day and time against the booking (read: that day's and the next day's bookings under that phone number — for an after-midnight time, the day before's too —, the bookings made through the chat with that email and phone, and the booking reference if one is given) — to show only that booking (bookings are never listed); after 3 failed attempts in a conversation, or 5 with the same email and phone, within the last 24 hours, ChatME stops searching and gives the restaurant's phone (the count of failed attempts is kept only on ChatME's side, as a keyed hash, and is never sent to Restoo). On WhatsApp: the sender's number, against ChatME's own record for chat bookings and the customer record's phone for others, to show only that number's bookings. In both cases, the change or cancellation of that verified visitor's own booking (write), with any cancellation fee quoted to them first. We also read the owner's venue profile (opening configuration, features, contact details) and availability, which is business data, not personal data. Webhooks from Restoo (booking events) keep ChatME's backup record current. The API key, stored encrypted (AES-256-GCM). |
| Region |
🇪🇸 EU — Restoo is a Spanish company (Madrid). |
| Transfer mechanism |
n/a (data stays in EEA). |
| DPA |
restoo.me/aviso-legal (includes its privacy policy) |
| Role |
Sub-processor (client-authorized integration). The data written to Restoo lives in the owner's own Restoo account (controller-side); the owner connects and disconnects it themselves. |
| Vendor |
Team Interactive S.L. ("Restoo"), Calle Estrella Denébola 10, 5C, 28045 Madrid, Spain (CIF B-83727479) |
| Notes |
Restoo is the source of truth for that data — availability, bookings, customer notifications and payments all live there. ChatME keeps a backup record of each booking the assistant made or changed there, updated from Restoo's webhooks (see the privacy policy's retention table: 365 days, then anonymised). The per-venue API key is deleted when the owner disconnects. |
13 · Telegram (Telegram bot messaging — only if connected)
|
|
| Service |
The Telegram Bot API — only when a ChatME owner connects their own Telegram bot (created in Telegram's @BotFather) to their chatbot, so the assistant can answer the people who write to that bot. |
| Data processed |
Messages a visitor sends to the business's bot, the visitor's Telegram user id and profile name (first and last name, as Telegram provides them), and the bot token (stored encrypted, AES-256-GCM) needed to receive and reply. Media (photos, voice notes, documents) is never downloaded: the assistant answers that it can only read text, and the conversation records a placeholder. |
| Region |
🌍 Multi — Telegram's own data centres (Telegram's privacy policy states where each region's users' data is held). |
| Transfer mechanism |
Telegram offers bot developers no DPA and no SCCs. The visitor chose to message the business on Telegram, whose own terms and privacy policy govern that platform; ChatME receives only what Telegram delivers to the bot and processes it to generate the reply. |
| DPA |
n/a — telegram.org/privacy · Bot Developer Terms |
| Role |
Sub-processor for the messaging relay; Telegram is an independent controller of its own platform data. |
| Vendor |
Telegram FZ-LLC (Dubai, UAE) / Telegram Messenger Inc. |
| Notes |
The owner can revoke the bot token in @BotFather at any time, which ends ChatME's access instantly; disconnecting in the dashboard releases the bot and deletes the stored token. A bot's conversations are visible only through the Bot API, i.e. in the ChatME dashboard — not in the owner's Telegram app. |
14 · Cloudflare (Turnstile bot check — app.chatme.es sign-up, sign-in and password reset — ChatME's own processor, not a sub-processor)
|
|
| Service |
Cloudflare Turnstile, a CAPTCHA alternative that checks that whoever creates an account, signs in with email and password, or asks for a password reset on app.chatme.es is a person and not an automated script. It runs when one of those three screens opens — also for someone who then signs in with Google, although Google sign-in does not need its result — and only there: not on the chatbot widget, the /c/ chat pages, the dashboard or chatme.es. |
| Data processed |
The browser signals Turnstile collects on those screens — per Cloudflare's Turnstile Privacy Addendum, signals such as the IP address, TLS fingerprint, User-Agent header, and our site key and the page's origin. According to Cloudflare's Turnstile documentation, Turnstile does not access, store or transmit form entries or other page inputs — what is typed into the form (email, password, name). When our authentication provider, Supabase (above), verifies the one-time token the check produces, it sends it to Cloudflare together with the IP address the request came from. |
| Region |
🌍 Multi — Cloudflare's global network; Cloudflare, Inc. is a US company. |
| Transfer mechanism |
EU-U.S. Data Privacy Framework (Cloudflare is certified, incl. the UK Extension and the Swiss-U.S. DPF), under which a transfer to Cloudflare is not a restricted transfer; if that certification lapses, Standard Contractual Clauses (Module 2, controller → processor) apply — Cloudflare's DPA §6.2 and §6.4. |
| DPA |
cloudflare.com/cloudflare-customer-dpa · Turnstile Privacy Addendum |
| Role |
ChatME's own processor, not a sub-processor. The check runs only on ChatME's own account screens, so Cloudflare handles only data ChatME itself controls (account holders and people signing up). It never receives data a customer controls (their end-users' or visitors' data), so it is not a sub-processor under the customer DPA and the 30-day notice for new sub-processors (Updates to this list, below) does not apply to it. Cloudflare is also an independent controller of the signals it uses to improve Turnstile's bot detection (Turnstile Privacy Addendum). |
| Vendor |
Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA |
| Notes |
Per the Turnstile Privacy Addendum, Cloudflare uses these signals to detect and block bots, not to identify, profile or target anyone; it also uses them, as an independent controller, to improve Turnstile's bot detection. ChatME does not store them: it only passes the one-time token (valid 5 minutes, usable once) to Supabase. Cookies and browser storage: Cookie Policy §3.2. |
Not on this list: the owner's own online store
When a ChatME owner on the E-commerce plan connects their online store (Magento 2, Magento 1 / OpenMage, Shopify, WooCommerce or PrestaShop), ChatME reads it live, read-only, on the owner's behalf: for an order question it sends the store only the order number a visitor gives (for live stock, on PrestaShop, the product name or reference asked about), compares the email and last name on our server, and passes a verified order's details to Anthropic (above) to word the reply. The store platform is not a ChatME sub-processor: it is the owner's own system — their server or hosting provider, or Shopify under the owner's own contract with Shopify — which already holds and processes those orders for the owner (the controller). ChatME does not engage it; it only asks it, with the owner's own key, for what the owner already keeps there. The store's API credential is stored encrypted (AES-256-GCM) at Supabase (above) and deleted when the owner disconnects. Details: privacy policy §3.7.
Summary table
| # |
Vendor |
Service |
Region |
Transfer |
Role |
| 1 |
Supabase |
Database + Auth + Storage |
🇮🇪 EU |
n/a |
Sub-processor |
| 2 |
Anthropic |
LLM inference |
🇺🇸 US |
SCCs |
Sub-processor |
| 3 |
OpenAI |
Embeddings |
🇺🇸 US |
SCCs |
Sub-processor |
| 4 |
Resend |
Email delivery |
🇺🇸 US |
SCCs |
Sub-processor |
| 5 |
Stripe |
Billing |
🇮🇪 EU |
n/a (primary) |
Joint controller (payments) / ChatME's processor |
| 6 |
Vercel |
Hosting + edge |
🌍 Multi |
SCCs |
Sub-processor |
| 7 |
Google |
Calendar (if connected) |
🇺🇸 US |
SCCs |
Sub-processor |
| 8 |
Meta |
IG/WhatsApp/Messenger (if connected) |
🇺🇸 US |
SCCs |
Sub-processor |
| 9 |
Google Analytics / Ads |
Marketing-site analytics + ads (consent) |
🇺🇸 US |
SCCs |
Processor / joint controller |
| 10 |
Jobber |
Field-service CRM — leads + appointments (if connected) |
🇨🇦 CA / 🇺🇸 US |
SCCs / adequacy |
Sub-processor |
| 11 |
Let's Book |
Boat-rental bookings (if connected) |
🇳🇱 EU |
n/a |
Sub-processor |
| 12 |
Restoo |
Restaurant table bookings (if connected) |
🇪🇸 EU |
n/a |
Sub-processor |
| 13 |
Telegram |
Bot messaging (if connected) |
🌍 Multi |
n/a (platform's own terms) |
Sub-processor |
| 14 |
Cloudflare |
Bot check (Turnstile) on app sign-up, sign-in and password reset |
🌍 Multi |
DPF (SCCs if it lapses) |
ChatME's processor, not a sub-processor / independent controller (Turnstile improvement) |
Updates to this list
We will notify ChatME customers at least 30 days before adding a new sub-processor. Notifications go to:
- The email on file for your ChatME account.
- Updates to this page on app.chatme.es.
If you object to a new sub-processor and we can't offer an alternative, you can terminate your subscription with a pro-rata refund for the unused portion.
Contact
Questions about this list, requests to exercise your data subject rights, or to object to a sub-processor: privacy@chatme.es
Data-protection queries and data-subject requests: privacy@chatme.es.