OmnioChat Sub-processors
The third parties that process personal data on behalf of OmnioChat customers, what each one does, and where it is located.
Version 1.0 · effective . Previous versions are available on request from legal@aa-labs.co.
A & A Labs engages the third parties below to process personal data on behalf of OmnioChat customers. Each is bound by a written agreement imposing data protection obligations no less protective than our Data Processing Addendum, and each is engaged only for the purpose stated.
1. Infrastructure and storage
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Contabo GmbH | Server hosting. The whole application runs here — web servers, the relational and document databases, cache and queues, realtime, and storage for message media | All Customer Data | Germany |
| Brevo | Transactional email — invitations, account verification, billing and security notices. Not used for message content or marketing to your contacts | Name, email address, message subject and body of the notification | France, Germany |
2. Messaging platforms
These are the channels you connect. Data flows to them because that is how a message reaches its recipient; each operates under its own terms with you as well as with us.
| Sub-processor | Purpose | Data processed |
|---|---|---|
| Meta Platforms — WhatsApp Business Platform | Delivering and receiving WhatsApp messages | Message content, phone numbers, delivery status |
| Meta Platforms — Messenger & Instagram | Delivering and receiving Messenger and Instagram Direct messages; publishing posts you compose | Message content, platform-scoped user ids, profile names and pictures, post content |
3. Payments
Payment providers receive billing data only. They do not receive conversation content, contacts or message media. Only the provider you actually check out through processes your data.
| Sub-processor | Purpose | Data processed |
|---|---|---|
| Stripe | Subscription billing and payment processing | Name, email, billing address, payment method (held by Stripe, not by us) |
| Paddle | Subscription billing as merchant of record, including tax handling | Name, email, billing address, payment method |
| Razorpay, Paystack, Mercado Pago, PayPal | Regional payment processing where selected | Name, email, billing address, payment method |
4. AI providers
| Sub-processor | Purpose | Data processed |
|---|---|---|
| Your configured provider (OpenAI-compatible) | Generating suggested replies and chatbot responses, and embedding your knowledge base | Prompts, retrieved knowledge-base passages, relevant conversation context. Engaged by you, under your own agreement with that provider — we are not a party to it. |
| NVIDIA | Platform fallback, used only where a workspace has not configured a provider of its own: generating suggested replies, chatbot responses, campaign and social copy, and indexing knowledge-base documents | Prompts, retrieved knowledge-base passages, and the conversation context sent with them. Avoidable by configuring your own provider, or by leaving the AI features unused. |
5. Commerce integrations
Engaged only if you connect a store. Data flows in the direction you configure, to give agents order context beside a conversation.
| Sub-processor | Purpose | Data processed |
|---|---|---|
| Shopify | Syncing customers, orders and carts from your store | Customer name, email, phone, order and cart records |
| WooCommerce (your own hosting) | Syncing customers, orders and carts from your store | Customer name, email, phone, order and cart records |
6. Changes to this list
We will update this page before a new sub-processor begins processing customer data, and notify workspace owners by email at least 30 days in advance. If you object on reasonable data protection grounds, tell us at dpo@aa-labs.co within that window; if we cannot offer an alternative, you may terminate the affected part of the Service without penalty as set out in the DPA.
To be notified of changes, email dpo@aa-labs.co asking to join the sub-processor notification list.