Sub-processors — Anro Agents

This page lists the providers Anro Technologies Limited engages to process personal data on behalf of AnroAgents customers. It is referenced by the Data Processing Agreement and forms part of it.

Always engaged

Provider	What it does for us	Personal data it can process	Where it processes
Amazon Web Services AWS EMEA SARL, Luxembourg	All hosting: compute, the databases holding agents and conversations, object storage for uploads, the CDN serving the widget and hosted pages, and sign-in.	Everything the Service stores — account data, agent configuration, uploaded documents, conversation transcripts and whatever a visitor shares in a chat.	European Union — Ireland (eu-west-1) and Frankfurt (eu-central-1)
Neon Databricks, Inc., United States Neon was acquired by Databricks; the contracting entity is Databricks, Inc., and Neon, LLC may invoice on its behalf.	The managed Postgres database holding the search index built from your knowledge base, and the public registry entries.	Whatever appears in the material you upload as a knowledge base. No conversation transcripts.	European Union — Frankfurt (eu-central-1). The provider is US-established, so its access is covered by the Standard Contractual Clauses in its own data processing addendum.
OpenAI OpenAI Ireland Ltd. is our contracting party, as it is for any customer established in the EEA or Switzerland; processing itself is carried out in the United States by OpenAI OpCo, LLC.	Generates the agent's replies, builds the search index embeddings, and classifies what an agent does. This is the AI model provider currently in use.	The conversation content sent for an answer and the knowledge-base material sent for indexing — including anything a visitor typed into the chat.	United States
Resend Plus Five Five, Inc., San Francisco, United States	Delivers our own transactional email — account, billing, retention and service notices sent to you — and the guides requested from anroagents.com/resources. Email your agent sends a visitor does not go through it: that requires a mailbox you connect yourself, and it is sent from there.	Your name and email address and the content of the message. Open and click tracking are not enabled, so no recipient IP address, device or location is collected.	United States
Revolut Revolut Payments UAB, Lithuania	Card payments for subscriptions and overage.	Billing contact and payment details of the customer. No visitor data.	European Union
NOWPayments	Cryptocurrency payments for subscriptions.	Billing contact of the customer and the transaction. No visitor data.	Outside the European Union — see the provider's own terms

Engaged only when you turn something on

These are reached because you connected them. Where you connect a system of your own, you are sending your data to your own account with that provider, under your agreement with them.

Provider	What it does	Personal data it can process
Google Google Ireland Limited	Gmail, where you connect a mailbox so the agent emails visitors from your address; Google Calendar, where you let the agent book meetings.	The visitor's email address and the content of the message or invitation.
HubSpot	Syncs conversations, contacts and deals into your own HubSpot portal.	Visitor contact details and conversation summaries you have configured it to send.
Shopify	Reads your product catalogue so the agent can answer questions about it, where you install the app.	Store data. No visitor data leaves us to Shopify beyond the app's own installation records.
Telegram	Runs your agent on a Telegram bot you created, where you connect one.	Messages exchanged in that bot, and the Telegram identity of whoever writes to it.
Your own webhook endpoint	Receives the events you subscribed it to.	Whatever the event carries — typically visitor contact details and lead data.
OpenSanctions	Sanctions screening before a referral-programme payout is made. Only referral partners are screened.	The partner's name and country. No customer or visitor data.

Our own website

Google Analytics and PostHog (EU region) run on anroagents.com and directory.anroagents.com, and only after you accept the cookie banner. They concern visitors to our site, where we are the controller rather than a processor — see the Privacy Policy.

On anroagents.com only, two further elements run where a visitor accepts the separate marketing category in that banner. The Apollo website tracker (Apollo.io, Inc., United States) resolves the visitor’s network address against Apollo’s business database so we can see which company visited us, and records the pages viewed. The OpenAI advertising pixel (OpenAI, L.L.C., United States) records that a visit came from an advertisement we placed and whether it converted, so we can measure what our advertising buys. Accepting analytics alone switches on neither, and these two are the only elements of our website that transfer data outside the European Union.

None of the four is part of the Service: they run on our own marketing site and receive no customer or end-visitor data from it.

We hold a signed data processing agreement with each provider in the table above; copies are available to customers under a confidentiality agreement. Where a provider keeps data for a period of its own after we ask for deletion, we state it here rather than leave it to the annexes: Resend deletes the data it holds for us within 90 days of the account being closed, and its own sub-processor list changes on 14 days' notice to us — which is why we commit to 30 days to you and watch theirs.

Changes to this list

We notify customers by email at least 30 days before a new sub-processor starts processing personal data, or before an existing one is replaced — including a change of AI model provider. If you object on reasonable data-protection grounds within that period, write to support@anroagents.com; if we cannot offer an alternative, you may terminate the affected part of the Service and receive a refund of fees paid for the unused remainder.