The table below lists every third-party processor we use to deliver the Digital Worker platform. Each entry shows the categories of personal data they may access, their location, and the lawful transfer mechanism for any processing outside the European Economic Area (EEA).
We notify customers under our Data Processing Agreement in advance of any addition or replacement, and customers may object on reasonable data-protection grounds.
Core sub-processors (always on)
| Provider | Service | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
|
Hostinger Hostinger International Ltd. |
VPS hosting (KVM Frankfurt), backups | All platform data at rest and in transit on our server | Frankfurt, Germany (EU) | Within EU — no third-country transfer |
|
OpenAI OpenAI, L.L.C. / OpenAI Ireland Ltd. |
LLM inference, embeddings, transcription, Realtime voice | Whatever the user types into agents that use OpenAI models (chat text, voice transcript, uploaded files, tool-call payloads) | United States (EU routing where available) | EU Standard Contractual Clauses (2021/914); OpenAI Zero-Data-Retention opt-in where contractually granted |
|
Anthropic Anthropic, PBC. |
LLM inference (Claude model family), Claude Agent SDK | Whatever the user types into agents that use Anthropic models | United States | EU Standard Contractual Clauses (2021/914) |
|
SMTP provider configured per deployment |
Transactional email (password reset, notifications, invoices) | Email address, name, transactional content | [INSERT PROVIDER + COUNTRY] | [INSERT SAFEGUARD] |
Optional sub-processors (engaged only when you use the feature)
| Provider | Service | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
|
Google Google Ireland Ltd. |
OAuth sign-in (only if the user chooses "Sign in with Google") | Profile name, email, profile image, Google account ID | Ireland (EU) with onward transfer to US | EU Standard Contractual Clauses; user-initiated transfer at sign-in |
|
Meta Meta Platforms Ireland Ltd. |
WhatsApp Business Platform — only when you connect a WhatsApp number to an agent (Klikeri / direct Cloud API) | Phone number, conversation content, media attachments | Ireland (EU) with onward transfer to US | EU Standard Contractual Clauses; Meta's WhatsApp Business Terms |
|
Infobip Infobip Ltd. |
WhatsApp / SMS BSP — only when you connect an Infobip-routed channel | Phone number, conversation content, delivery metadata | Croatia / United Kingdom (EU + UK adequacy) | Within EU/UK adequacy; no third-country transfer |
|
Twilio Twilio Ireland Ltd. |
SMS / voice — only when you connect a Twilio channel | Phone number, conversation content | Ireland (EU) with onward transfer to US | EU Standard Contractual Clauses |
|
Stripe Stripe Payments Europe Ltd. |
Subscription billing (only paid customers) | Billing name, email, VAT ID, payment-method identifier (no full card data — held by Stripe) | Ireland (EU) with onward transfer to US | EU Standard Contractual Clauses; PCI-DSS compliant |
Self-hosted services (not sub-processors)
The following components run inside the same hosting boundary as the Digital Worker application and are operated by Apex Academy d.o.o., not by a third party:
- MySQL — primary application database
- Redis — session store, rate limiting, job queue
- Qdrant — vector database for retrieval- augmented generation
Notifications and objections
Material changes to this list are announced at least 30 days in advance to the email address on file for each customer's primary admin. To object to a new sub-processor or to be notified outside the email channel, contact privacy@apexacademy.hr.