AIRON TEAM SL acts as processor on behalf of each customer company. Art. 28.2 GDPR forbids engaging another processor without the controller’s authorisation. AIRON operates under a general authorisation, which obliges us to inform of every addition or replacement and to allow the customer to object. This page is the living annex to the data processing agreement.
1. Sub-processor list
| Provider | Entity and country | Processing location | Function and data received | Transfer mechanism | Status |
|---|---|---|---|---|---|
| OpenAI | OpenAI, L.L.C. — United States | United States | Language-model inference: prompts, contexts (fragments of email, invoices or CRM) and generated outputs. | Standard Contractual Clauses (Module 3) of OpenAI’s data processing addendum, being formalised. | In use |
| Alibaba Cloud | Alibaba Cloud — Singapore | Singapore | Qwen model endpoint listed in the catalogue, disabled and not assigned to production. | Not applicable: the endpoint is disabled and receives no data. | Not in use (disabled) |
| Groq | Groq, Inc. — United States | United States | Fallback inference. It would receive prompts and contexts only if activated. | To be completed (DPF or Standard Contractual Clauses) before enabling traffic. | No traffic |
| NVIDIA | NVIDIA Corporation — United States | United States | Hosted-model inference (NIM). It would receive prompts and contexts only if activated. | To be completed (DPF or Standard Contractual Clauses) before enabling traffic. | No traffic |
| ElevenLabs | ElevenLabs — United States | United States | Speech synthesis: the text to be voiced and, where applicable, reference audio. | Standard Contractual Clauses (Module 3), being put in place. | Subject to customer activation |
| RunPod | RunPod — United States | RunPod data centres; model training only in the European Union (Sweden) | On-demand GPU compute: the optional “AIRON (Qwen3.5-27B)” mode of the Assistant, enabled only for pilot accounts, and occasional training of our own search models with queries from pilot customers. | Standard Contractual Clauses (Module 3), being put in place. | Limited use (pilot) |
| Meta (WhatsApp e Instagram) | Meta Platforms Ireland Ltd. — Ireland (with processing also in the United States) | Ireland (EU) and United States | WhatsApp Business and Instagram messaging: messages, phone numbers and contact identifiers. | Meta’s terms with its own Standard Contractual Clauses. | Subject to customer activation |
| Google Ireland Ltd. — Ireland (part of the processing by Google LLC, United States) | Ireland (EU) and United States; embeddings in Germany (EU) | OAuth sign-in, Gmail, Drive, Calendar, Google Ads, GA4, Search Console, YouTube and Business Profile: email content, files, events, metrics and audiences. Since 19 September 2026, Google Cloud Vertex AI (europe-west3, Frankfurt) computes the search embeddings: it receives the text of indexed fragments and of queries. | Google’s Data Processing Addendum with Standard Contractual Clauses; Google LLC certified under the DPF. | In use, subject to customer activation | |
| Microsoft | Microsoft Ireland Operations Ltd. — Ireland | European Union (EU Data Boundary) | Microsoft 365, OneDrive and Outlook: email content, files and calendar. | Processing within the EU; Standard Contractual Clauses of Microsoft’s DPA for any residual processing outside the EEA. | Subject to customer activation |
| Twilio | Twilio Ireland Ltd. — Ireland / Twilio Inc. — United States | Ireland (EU) and United States | Telephony and voice: phone numbers, call audio and call metadata. | Standard Contractual Clauses of Twilio’s DPA; the Irish data region is enforced. | Subject to customer activation |
| IONOS | IONOS SE — Germany | Frankfurt am Main, Germany (EU) | Server hosting: all the platform’s infrastructure, databases and files. | Not applicable: processing takes place entirely within the European Union. | In use |
| GitHub | GitHub, Inc. (Microsoft) — United States | United States | Export of websites built with Web Studio to the customer’s own repository. | Standard Contractual Clauses of the Microsoft/GitHub DPA; the destination is the customer’s repository. | Subject to customer activation |
| Telegram | Telegram (Bot API) — contracting entity being determined | To be determined | Internal operator messaging channel: operator messages and chat identifiers. It is not used to communicate with third parties. | To be determined. In the meantime, the channel is limited to internal operational messaging. | In use (internal) |
| Stripe | Stripe Payments Europe Ltd. — Ireland / Stripe, Inc. — United States | Ireland (EU) and United States | AIRON’s own billing to its customers: contact and payment data. In this processing AIRON acts as controller, not as processor. | Standard Contractual Clauses of Stripe’s DPA; Stripe, Inc. certified under the DPF. | Limited use (own billing) |
Not every provider receives every customer’s data: those marked «subject to customer activation» come into play only if that company connects that service. We are completing the contractual file (processing agreement, standard clauses and transfer assessment) with each provider; you can request the current status at privacidad@airon.team.
2. Local components: not sub-processors
These components run entirely on AIRON’s own infrastructure in Frankfurt. There is no disclosure of data to a third party and therefore neither a sub-processing contract nor an international transfer applies.
| Component | Function and data received |
|---|---|
| SearXNG | Web search for the agents, self-hosted on our own server. |
| AIRON CRM | Self-hosted CRM at crm.airon.team, on the same infrastructure. |
3. International transfers
Hosting (servers, databases, files and backups) and search indexing take place in the European Union; language-model inference is provided by OpenAI in the United States. For providers located in third countries, Chapter V GDPR applies: an adequacy decision, the EU-US Data Privacy Framework where the importer is certified and active, or the Standard Contractual Clauses of Implementing Decision (EU) 2021/914, Module 3 (processor to sub-processor), with the necessary supplementary measures and a transfer impact assessment reviewed at least annually.
Routing rule. Before a new provider located outside the EEA or outside a country with an adequacy decision is added, a complete transfer file is required. For the current inference provider (OpenAI, United States) the data processing addendum and the transfer impact assessment are being formalised. At reasonably equal quality and cost we prefer, in this order: a local model on our own server, a provider processing within the EU, a provider covered by adequacy or an active DPF certification, and a provider with standard clauses and a favourable assessment.
4. How changes are notified
- Written notice to every customer controller 30 calendar days in advance of the new sub-processor starting to process data.
- Content of the notice: provider name and entity, function, categories of data, processing location, transfer mechanism and expected start date.
- Channel: email to each customer’s privacy contact and publication on this page.
- Right to object with reasons within that period. If the objection is well founded and no reasonable alternative exists, the customer may terminate the affected service without penalty, with the 30-day transition period described in portability and switching providers.
- For a replacement or removal: the same 30-day notice, confirmation that the outgoing provider has deleted the data, and an update of this page.
5. Change log
| Date | Change |
|---|---|
| 26 September 2026 | RunPod moves to “limited use (pilot)”: it serves the optional “AIRON (Qwen3.5-27B)” mode of the Assistant for pilot accounts and occasional training of our own search models, done only in the EU (Sweden). OpenAI: the transfer mechanism is corrected to the Standard Contractual Clauses of its data processing addendum, being formalised (the reference to the EU-US Data Privacy Framework is withdrawn). We clarify that hosting and indexing take place in the EU and inference in the United States. Correction to the 2 September entry: NVIDIA did receive traffic until 19 September, as it computed the search embeddings; since that day it receives none. |
| 19 September 2026 | Google: search embeddings are now computed on Google Cloud Vertex AI, europe-west3 region (Frankfurt, EU); indexed content does not leave the EU to be vectorised. Google’s description now also lists Calendar, YouTube and Business Profile, which were already in use. No new provider is added. |
| 2 September 2026 | Initial publication of the list, with 14 providers. Alibaba Cloud is disabled and unused. No new sub-processor has been added relative to the previous situation. |
The context for this list is the AIRON platform privacy policy. Questions: privacidad@airon.team or info@airon.team.