Last updated: October 16, 2026
This page lists the providers Anro Technologies Limited engages to process personal data on behalf of AnroAgents customers. It is referenced by the Data Processing Agreement and forms part of it.
These providers are involved in running the Service for every customer.
| Provider | What it does for us | Personal data it can process | Where it processes |
|---|---|---|---|
| Amazon Web Services AWS EMEA SARL, Luxembourg |
All hosting: compute, the databases holding agents and conversations, object storage for uploads, the CDN serving the widget and hosted pages, and sign-in. | Everything the Service stores — account data, agent configuration, uploaded documents, conversation transcripts and whatever a visitor shares in a chat. | European Union — Ireland (eu-west-1) and Frankfurt (eu-central-1) |
| Neon Databricks, Inc., United States Neon was acquired by Databricks; the contracting entity is Databricks, Inc., and Neon, LLC may invoice on its behalf. |
The managed Postgres database holding the search index built from your knowledge base, and the public registry entries. | Whatever appears in the material you upload as a knowledge base. No conversation transcripts. | European Union — Frankfurt (eu-central-1). The provider is US-established, so its access is covered by the Standard Contractual Clauses in its own data processing addendum. |
| Anthropic Anthropic Ireland, Limited is our contracting party, as it is for any customer established in the EEA; the processing itself is carried out in the United States. |
Generates the agent's replies with its Claude models, checks each reply, summarises and translates conversations, describes photos a visitor sends, and classifies what an agent does. In use since 8 October 2026. | The conversation content sent for an answer — the agent's instructions, the matching knowledge-base passages, the recent conversation, and anything a visitor typed or sent into the chat. Deleted within 30 days by default; a request flagged by Anthropic's safety systems as a usage-policy violation can be kept for up to 2 years. | United States for stored data; the model may run in any region Anthropic operates |
| OpenAI OpenAI Ireland Ltd. is our contracting party, as it is for any customer established in the EEA or Switzerland; processing itself is carried out in the United States by OpenAI OpCo, LLC. |
Builds the search index embeddings for the knowledge base and the public registry. It does not write replies. | The knowledge-base material sent for indexing, the short search query built from a visitor's latest messages on each turn, and the public description of an agent listed in the registry. Kept up to 30 days for abuse monitoring. | United States |
| Resend Plus Five Five, Inc., San Francisco, United States |
Delivers our own transactional email — account, billing, retention and service notices sent to you — and the guides requested from anroagents.com/resources. Email your agent sends a visitor does not go through it: that requires a mailbox you connect yourself, and it is sent from there. | Your name and email address and the content of the message. Open and click tracking are not enabled, so no recipient IP address, device or location is collected. | United States |
| Revolut Revolut Payments UAB, Lithuania |
Card payments for subscriptions and overage. | Billing contact and payment details of the customer. No visitor data. | European Union |
| NOWPayments | Cryptocurrency payments for subscriptions. | Billing contact of the customer and the transaction. No visitor data. | Outside the European Union — see the provider's own terms |
These are reached because you connected them. Where you connect a system of your own, you are sending your data to your own account with that provider, under your agreement with them.
| Provider | What it does | Personal data it can process |
|---|---|---|
| Google Google Ireland Limited |
Gmail, where you connect a mailbox so the agent emails visitors from your address; Google Calendar, where you let the agent book meetings. | The visitor's email address and the content of the message or invitation. |
| HubSpot | Syncs conversations, contacts and deals into your own HubSpot portal. | Visitor contact details and conversation summaries you have configured it to send. |
| Shopify | Reads your product catalogue so the agent can answer questions about it, where you install the app. | Store data. No visitor data leaves us to Shopify beyond the app's own installation records. |
| Telegram | Runs your agent on a Telegram bot you created, where you connect one. | Messages exchanged in that bot, and the Telegram identity of whoever writes to it. |
| Your own webhook endpoint | Receives the events you subscribed it to. | Whatever the event carries — typically visitor contact details and lead data. |
| OpenSanctions | Sanctions screening before a referral-programme payout is made. Only referral partners are screened. | The partner's name and country. No customer or visitor data. |
Google Analytics and PostHog (EU region) run on anroagents.com and directory.anroagents.com, and only after you accept the cookie banner. They concern visitors to our site, where we are the controller rather than a processor — see the Privacy Policy.
On anroagents.com only, three further elements run where a visitor accepts the separate marketing category in that banner. The Apollo website tracker (Apollo.io, Inc., United States) resolves the visitor’s network address against Apollo’s business database so we can see which company visited us, and records the pages viewed. The OpenAI advertising pixel (OpenAI, L.L.C., United States) records that a visit came from an advertisement we placed and whether it converted, so we can measure what our advertising buys; for a visitor who accepted it, the dashboard at app.anroagents.com reports to it only that an account was created. The Meta Pixel (Meta Platforms Ireland Limited, with processing in the United States) does the same for our advertising on Instagram and Facebook, and also lets us show those ads again to people who visited; we and Meta are joint controllers for collecting that data. Accepting analytics alone switches on none of them, and these three are the only elements of our website that transfer data outside the European Union.
None of the five is part of the Service: they run on our own marketing site and receive no customer or end-visitor data from it — the bare fact of a sign-up above is the only thing the dashboard passes on.
We hold a data processing agreement with each provider in the table above — signed, or, for Anthropic, its Data Processing Addendum incorporated into its Commercial Terms; copies are available to customers under a confidentiality agreement. Where a provider keeps data for a period of its own after we ask for deletion, we state it here rather than leave it to the annexes: Anthropic deletes API inputs and outputs within 30 days by default (up to 2 years for a request flagged as a usage-policy violation), OpenAI keeps embedding requests up to 30 days, Resend deletes the data it holds for us within 90 days of the account being closed, and its own sub-processor list changes on 14 days' notice to us — which is why we commit to 30 days to you and watch theirs.
We notify customers by email at least 30 days before a new sub-processor starts processing personal data, or before an existing one is replaced — including a change of AI model provider. If you object on reasonable data-protection grounds within that period, write to support@anroagents.com; if we cannot offer an alternative, you may terminate the affected part of the Service and receive a refund of fees paid for the unused remainder.
← Back to Anro Agents · Data Processing Agreement · Security · Privacy