Sub-processors

Last updated: 13 June 2026

This page lists every third party that Apex Chatbot engages to process personal data on behalf of its customers. All sub-processors are bound by a Data Processing Agreement.

As a data processor ourselves, we rely on the following sub-processors to operate the service. Each sub-processor has been vetted for GDPR compliance and is bound by contractual obligations at least as protective as those we owe you. Transfers outside the EEA rely on Standard Contractual Clauses or the EU-US Data Privacy Framework.

Supabase, Inc.
Role: Database, authentication, edge functions
Location: EU (Frankfurt)
Data processed: Account data, chatbot conversations, audit log
View DPA
Vercel, Inc.
Role: Application hosting and CDN
Location: EU edges with US fallback
Data processed: Application traffic, IP addresses
View DPA
OpenAI, OpCo, LLC
Role: Chatbot reply generation
Location: USA
Data processed: Conversation text, chatbot messages
Notes: EU-US Data Privacy Framework certified
View DPA
Anthropic PBC
Role: Optional model routing (only when explicitly enabled)
Location: USA
Data processed: Conversation text (only when enabled)
Notes: EU-US Data Privacy Framework certified
View DPA
Stripe Payments Europe Ltd.
Role: Payments and subscription management
Location: Ireland (EU) with US fallback
Data processed: Billing data, payment metadata
View DPA
Resend Software, Inc.
Role: Transactional email delivery
Location: USA
Data processed: Email address, email content
View DPA
Cloudflare, Inc.
Role: DNS and edge security in front of apexchatbot.com
Location: USA with global edge
Data processed: IP addresses, request metadata
View DPA
Vapi (Pipecat AI, Inc.)
Role: Voice agent platform (only when the Voice product is used)
Location: USA
Data processed: Voice call audio, transcript
Notes: Per-service agreement applies
View DPA
Notification of new sub-processors

We will notify the Customer at least 14 days in advance of adding a new sub-processor. Notification is sent by email to the account owner.

Right to object

The Customer may object to a new sub-processor by emailing dpo@apexweb.hu within the notice period. If the objection cannot be resolved, the Customer may terminate the subscription with a pro-rata refund for the unused period.