As at 17 August 2026. The current list is maintained at [URL: aici.com.ua/subprocessors], with change notification as set out in Section 7.3 of the Data Processing Agreement.
C.1 Infrastructure
| Sub-processor | Purpose | Location of processing | Transfer mechanism | Content used for training / retention |
|---|---|---|---|---|
| Lovable AB (Sweden) — Lovable Cloud | Provision and administration of the hosting, database, storage, authentication and edge-function environment | EU (Frankfurt) | Intra-EEA — no transfer mechanism required | Not used for training |
| Supabase Inc. (United States) | Underlying database, storage, authentication and compute platform; parent-entity support and administrative access | Storage in EU (Frankfurt); support access may originate from the United States | SCCs 2021/914 (Module Three) within the Lovable/Supabase DPA chain | Not used for training; retention per AICI configuration |
C.2 AI processing
| Sub-processor | Purpose | Location of processing | Transfer mechanism | Content used for training / retention |
|---|---|---|---|---|
| Lovable AI Gateway | Routing layer through which all AI model calls are made | EU / US | SCCs (within the Lovable Cloud DPA) | Not used for training; gateway does not store request content |
| ElevenLabs Inc. (Scribe) | Automatic speech recognition and speaker diarization | EU | Storage and processing in the EEA. SCCs 2021/914 apply as a backstop to any support or administrative access originating from the provider's US establishment | Not used for training. ⚠️ Retention period pending written confirmation — see Annex E |
| Google LLC (Gemini family) | Summarization, translation, thematic coding, text-based sentiment labelling, generation of reports, personas and CJMs | United States | SCCs 2021/914 | Not used for training (Gemini API enterprise terms) |
| OpenAI LLC (fallback path) | Summarization, thematic coding, document generation | United States | SCCs 2021/914 + provider DPA | Not used for training. Retained up to 30 days for abuse monitoring under the provider's API terms |
C.3 Media processing
| Sub-processor | Purpose | Location of processing | Transfer mechanism | Content used for training / retention |
|---|---|---|---|---|
| Shotstack Pty Ltd | Rendering of video clips for the video showcase feature | Australia | SCCs 2021/914 | Not used for training |
C.4 Operations
| Sub-processor | Purpose | Location of processing | Transfer mechanism | Content used for training / retention |
|---|---|---|---|---|
| Stripe, Inc. | Payment and subscription processing | US / EU | SCCs + provider DPA | N/A — no Customer Content |
| Resend, Inc. | Transactional e-mail and system notifications | United States | SCCs + provider DPA | N/A — no Customer Content |
C.5 Customer-initiated integrations
The following are engaged only where an Authorized User connects the relevant account and are used solely to retrieve recordings on that user's instruction. Where Customer does not connect an integration, no data is transmitted.
| Sub-processor | Purpose | Location of processing | Transfer mechanism | Content used for training / retention |
|---|---|---|---|---|
| Zoom Communications, Inc. | Import of meeting recordings | United States | SCCs + provider DPA | N/A |
| Google LLC (Google Workspace / Meet API) | Import of meeting recordings | United States | SCCs 2021/914 | N/A |
C.6 Services not used
For the avoidance of doubt, as at the date of this Annex the Company does not use:
- any third-party customer-support platform — support is provided through an in-product page and by e-mail;
- any third-party product analytics or error-tracking service (such as Sentry, PostHog or Google Analytics) — application errors are written to an internal database table within the Company's own EU-hosted environment, with notifications sent by e-mail;
- any separate cloud host beyond the infrastructure listed in C.1;
- any advertising, tracking or data-enrichment service.