> ## Documentation Index
> Fetch the complete documentation index at: https://docs.setor.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Setor AI Third-Party Subprocessors — Full Named List
> Named subprocessors Setor AI uses to deliver the service, organised by category. At least 14 days' advance notice is given before any subprocessor change.
Setor AI uses the following third-party subprocessors to provide the service. As our customer, you authorise us to use these processors under the terms of our Data Processing Agreement. We provide at least **14 days' advance notice** before adding or replacing any subprocessor, and you may object on documented data-protection grounds within that notice period.
This list reflects the current named subprocessors. The authoritative versioned list is always published at [https://setor.ai/subprocessors](https://setor.ai/subprocessors). To object to a subprocessor change, email [office@setor.ai](mailto:office@setor.ai).
## AI Models
Setor AI uses multiple AI providers to analyse messages, understand intent, generate responses, transcribe voice notes, synthesise voice, and process images and video content.
| Subprocessor | Purpose | Location | Transfer mechanism | Trains on your data |
| ---------------- | ------------------------------------------- | -------- | -------------------- | ------------------- |
| OpenAI, L.L.C. | Response generation, language understanding | USA | DPF + SCC (2021/914) | No |
| Anthropic, PBC | Response generation, language understanding | USA | DPF + SCC (2021/914) | No |
| Google LLC | AI analysis, language models | USA | DPF + SCC (2021/914) | No |
| OpenRouter, Inc. | AI processing gateway | USA | SCC (2021/914) | No |
| Groq, Inc. | Audio transcription, voice note processing | USA | SCC (2021/914) | No |
| ElevenLabs, Inc. | Voice synthesis | USA | SCC (2021/914) | No |
**Data processed:** DM message content, voice note audio, image metadata. Processing is transient — data is not retained by AI sub-processors after session completion, except for limited abuse-prevention logging (typically 30 days, auto-deleted). No AI sub-processor uses your data to train its own general models.
**Transfer mechanism:** SCC (EU 2021/914) or EU-US DPF where applicable. Transfer Impact Assessments conducted for all US processors.
***
## Hosting and Infrastructure
| Subprocessor | Purpose | Location | Transfer mechanism |
| ------------------- | -------------------------------------------- | ------------ | -------------------- |
| Hetzner Online GmbH | Primary cloud infrastructure and database | Germany (EU) | Within EEA |
| Cloudflare, Inc. | CDN, WAF, DDoS protection, frontend delivery | USA / Global | DPF + SCC (2021/914) |
**Data processed:** All customer and end-user data as required to operate the platform. The **primary database is located within the EEA** (Germany). Cloudflare processes network-layer data for routing, security, and performance.
**Retention:** Data is retained for the periods specified in the Privacy Policy and Data Processing Agreement.
***
## Payments
| Subprocessor | Purpose | Location | Transfer mechanism |
| ------------ | ------------------------------------------- | -------- | -------------------- |
| Stripe, Inc. | Payment processing and subscription billing | USA | DPF + SCC (2021/914) |
**Data processed:** Billing name and address, last four digits of payment card, transaction identifiers, subscription status. Stripe is **PCI-DSS Level 1 certified** — full card details are collected and stored exclusively by Stripe and never touch Setor AI servers.
***
## Email and Communication
| Subprocessor | Purpose | Location | Transfer mechanism |
| -------------------- | -------------------------------------- | -------- | ------------------ |
| Resend | Transactional email delivery | USA / EU | SCC (2021/914) |
| Meta Platforms, Inc. | Instagram, Facebook messaging channels | USA | DPF |
**Data processed:** Email address, notification content. Message channel data (Instagram DMs) is processed via Meta under the Meta Platform Terms.
***
## Analytics and Session Recording
| Subprocessor | Purpose | Location | Transfer mechanism |
| ----------------- | ----------------------------------------------------------- | -------------- | ------------------ |
| PostHog | Product analytics (consent required) | EU (Frankfurt) | Within EEA |
| Microsoft Clarity | Session recording for usability analysis (consent required) | USA | SCC (2021/914) |
| New Relic, Inc. | Application performance monitoring | USA | SCC (2021/914) |
**Data processed:** Usage events, page views, interaction patterns, session recordings. Analytics and session recording scripts load **only after your prior active consent** — they are not loaded on page load by default.
**Microsoft Clarity:** All text input fields are **masked by default** — no form content or personal text is captured in session recordings.
**PostHog:** First-party data only; EU data residency (Frankfurt); not used for PostHog's own advertising; data not shared with third parties for advertising purposes.
**Retention:** Up to 36 months, then deletion or anonymisation.
***
## Marketing Attribution
| Subprocessor | Purpose | Location | Transfer mechanism |
| -------------------- | -------------------------------------------------------------------------------------------- | -------- | ------------------ |
| Meta Platforms, Inc. | Meta Pixel and Conversions API for conversion tracking and ad attribution (consent required) | USA | DPF |
**Data processed (consent required):** Hashed identifiers (SHA-256 hashed email, phone, first name, last name, external ID), conversion events, browsing behaviour on setor.ai. **Raw IP addresses are never stored in analytics systems.** An `ip_hash` pseudonym may be used solely to link events from the same lead across devices — it is never used as an identity key.
US transfers for Meta are covered by the EU-US Data Privacy Framework (DPF), with SCC (2021/914) as automatic fallback.
***
## CRM and Scheduling
| Subprocessor | Purpose | Location | Transfer mechanism |
| ------------ | ---------------------------------------- | -------- | -------------------- |
| Attio | CRM and customer relationship management | USA / EU | SCC (2021/914) |
| Calendly | Calendar scheduling integration | USA | DPF + SCC (2021/914) |
| Cal.com | Calendar scheduling integration | USA / EU | SCC (2021/914) |
| GoHighLevel | Calendar scheduling and CRM integration | USA | SCC (2021/914) |
| Gleap | Customer support tooling | EU | Within EEA |
**Data processed:** Contact records, meeting booking data, support ticket content as necessary for the respective function. Scheduling integrations process calendar availability and meeting metadata.
***
## Public Data Verification
| Subprocessor | Purpose | Location | Transfer mechanism |
| ------------ | ------------------------------------- | -------- | ------------------ |
| Apify | Public Instagram profile verification | USA / EU | SCC (2021/914) |
**Data processed:** Publicly available Instagram profile data only (follower count, business category, account activity). Used solely to verify eligibility of accounts submitted in onboarding forms — not for monitoring or surveillance of end users.
***
## Video and Content
| Subprocessor | Purpose | Location | Transfer mechanism |
| ------------ | ------------------------------------ | -------- | ------------------ |
| Wistia | Video hosting and playback analytics | USA | SCC (2021/914) |
**Data processed:** Video view events, playback progress. Used to deliver and measure engagement with embedded video content on setor.ai pages.
***
## Sub-processor Change Notification
Setor AI follows a formal procedure for all sub-processor additions and changes:
Setor AI sends you **at least 14 days' advance notice** by email of any planned addition or replacement of a sub-processor. Notices are also reflected in the versioned list at [setor.ai/subprocessors](https://setor.ai/subprocessors).
You may object to a proposed change on **documented, justified data-protection grounds** specific to that sub-processor. Objections must be submitted to [office@setor.ai](mailto:office@setor.ai) within the 14-day notice period.
Upon a valid objection, Setor AI and you will negotiate in good faith to find a solution. If no agreement is reached, your sole remedy is to terminate the affected portion of the service. An objection does not constitute a veto over Setor AI's operations.
**Silence after the 14-day notice period is treated as acceptance.** By continuing to use the service after the notice period expires, you accept the new or changed sub-processor.
For the full named and versioned subprocessor list, visit [https://setor.ai/subprocessors](https://setor.ai/subprocessors). To object to a subprocessor change, email [office@setor.ai](mailto:office@setor.ai).