Subprocessors
Third parties Velen engages to deliver the Service
Under GDPR Art. 28 we're required to disclose every party we share personal data with. The list below is current as of 2026-05-20. We update it before engaging new subprocessors and notify active customers by email at least 14 days in advance of any change.
| Subprocessor | Purpose | Data | Location | DPA |
|---|---|---|---|---|
| Anthropic | AI language model — generates and verifies replies | Customer messages, business profile, conversation history | United States (SCCs applied) | DPA ↗ |
| OpenAI | Embedding generation for RAG retrieval | Knowledge base text chunks (not customer messages) | United States (SCCs applied) | DPA ↗ |
| Neon | Postgres database hosting | All application data (workspace-scoped, encrypted at rest) | European Union (London region) | DPA ↗ |
| Vercel | Application + edge hosting | HTTP request logs, application code | European Union | DPA ↗ |
| Clerk | Authentication, session management | Account email, password hash, session tokens | United States (SCCs applied) | DPA ↗ |
| Postmark | Transactional email delivery (inbound + outbound) | Email addresses, subject lines, message body | European Union (EU servers) | DPA ↗ |
| Stripe | Billing, payment processing | Billing email, payment method (held by Stripe) | United States / European Union | DPA ↗ |
| Meta Platforms | WhatsApp / Messenger / Instagram channel integration | Messages sent to your connected Meta accounts, channel access tokens | United States / European Union | DPA ↗ |
Cross-border transfers
Where data is transferred outside the UK/EU (notably to Anthropic, OpenAI, Clerk, and Stripe in the US), we rely on Standard Contractual Clauses (SCCs) and supplementary measures (encryption in transit, no training on data) as required by the Schrems II ruling.
No training
Anthropic, OpenAI, and the other AI providers we use do not train their models on data sent via their commercial APIs. This is contractually binding under their published API data policies.
Contact
Questions about subprocessors? Email legal@velen.ai.