Sub-processors

This list is Annex 3 to the Data Processing Agreement and forms part of the technical and organisational measures.

1. The short answer

No third party is involved in answering a question. The script answely.js sends data exclusively to Answely's own infrastructure, and the language model runs on own hardware in Łódź, Poland – the AI operates exclusively on servers in the EU, and nothing is sent to an external AI service. There is no hosting or cloud provider for operations.

Data that Answely processes on behalf of its customers reaches third parties in only two cases:

A nightly off-site copy of all databases of the server is stored at Google Cloud Storage in Warsaw. It is encrypted on our own server before transfer, including file and directory names; the keys are held only by the operator. Google cannot read the content but nevertheless remains a sub-processor – encryption deprives Google of the content, not of the role.
Emails to customers are sent via Namecheap Private Email in the USA. Data processed on behalf of customers is contained above all in the monthly knowledge-gap report, which customers can switch on: it contains groups of masked questions. With this report, masked question texts leave the EU, on the basis of the EU standard contractual clauses. Without the report, questions and answers from the answer box do not leave the EU.

All other entries concern the customer account (payment, emails) or technical operations – not the data of visitors to our customers' websites.

2. Current sub-processors and recipients

Recipient	Purpose	Data categories	Location	Legal basis
Google Ireland Limited (Google Cloud Storage)	Off-site copy of the server's nightly backup	Complete copy of all databases and of the web directory: accounts, settings and index of the sites, answer box analytics, company logos. Encrypted before transfer (rclone crypt, keys held only by the operator), including file and directory names.	Poland (EU) – non-public storage in the region europe-central2 (Warsaw), storage class Standard	Processing on behalf under the Google Cloud data processing terms as accepted for the cloud project.
Namecheap, Inc., Phoenix, Arizona, USA (Namecheap Private Email)	Sending transactional emails to customers and the knowledge-gap report; receiving incoming emails to addresses under @answely.com	Name and email address of the recipient, content of the message: confirmations, password resets, quota warnings, payment notices, deletion confirmation; for the knowledge-gap report, groups of masked questions and the customer's company logo; for incoming emails, their content	USA (third country)	Namecheap Data Processing Addendum with EU standard contractual clauses (Art. 46(2)(c) GDPR), accepted on 01.08.2026 for the legal entity's account.
Stripe Payments Europe, Ltd.	Payment processing, invoices, tax calculation and customer portal for paid plans and add-on packages	Customer account data only: email address, name or company, address for businesses, country, customer type, language, Answely account number, verified VAT ID. Card and bank account details are entered on Stripe's pages and never reach Answely. Never visitor data.	Ireland (EU); transfer to Stripe, Inc., USA	Stripe Data Processing Agreement, accepted on 01.08.2026 with the terms upon account opening; for the USA, EU-US Data Privacy Framework, alternatively standard contractual clauses.
Let's Encrypt (ISRG)	Issuing and renewing TLS certificates	Domain names only; no personal data of customers or visitors	USA	Public certification authority; no processing of personal data on behalf
Namecheap, Inc., Phoenix, Arizona, USA (registrar)	Registration of the domain answely.com and authoritative DNS	Domain data of the operator only; no data of customers or visitors. Incoming email does not pass through domain management but through Namecheap Private Email (row above).	USA	Registrar agreement; no processing of personal data on behalf
None – operation on own hardware in Łódź, Poland, including the machines running the language model and the embedding model	Operation of website, account, answer service, databases and AI	All data processed by Answely	Poland (EU)	Not applicable: no transfer to a hosting third party. The internet connection (Toya sp. z o.o., AS16342) is pure transport and TLS-encrypted throughout; its provider is not a sub-processor.

Regarding retention of the off-site copies: daily copies 7 days, weekly copies 364 days. Data deleted in the live system may remain in them until they expire, encrypted and only for restoration after a loss; details in the Data Processing Agreement, section 12.3.

Strictly speaking, Stripe is not a sub-processor acting on behalf of customers for billing, because Answely is itself the controller for billing. The row is nevertheless listed here so that the list shows completely who receives data from Answely's environment.

3. What is deliberately not on this list, and why

AI models: The language model and the embedding model run on own hardware in the same internal network as the server. There is no AI provider that receives questions, answers or content.
Fallback provider for the language model: A provider with its registered office and data centre in France is technically prepared but not in operation; its activation is blocked. It would only be added to this list if it processes exclusively in the EU, contractually commits to no training and no storage beyond the request, and customers have been informed 30 days in advance. Providers outside the EU are excluded.
reactive.chat: For sites from reactive.chat, answers come from its knowledge base. reactive.chat is operated by the same legal entity and is therefore not a third party. The privacy policy, data processing agreement and list of sub-processors of reactive.chat expressly name these answers ("Smart Answer") as a service of Answely.
consented.eu: The consent banner on answely.com is a separate product of the same legal entity. On customers' websites, Answely only reads the consent signal in the browser; nothing is sent to the provider of a customer's consent tool. consented.eu runs on the same server in Łódź as Answely.
formconfirmed: The form protection on the public forms of answely.com (sign-in, registration, password, support, quick check) is a product of formexposed belonging to the same legal entity and runs on the same server in Łódź as Answely. It only concerns data for which we ourselves are the controller, not data from the answer box on customers' websites; details in section 3.7 of the privacy policy.
Endpoints determined by customers themselves: WordPress installation, public data sources for live data, targets of action and support links, AI clients at the public MCP access point and – once enabled – sign-in providers for protected areas. They are connected only on the customer's instructions; the contractual relationship exists between the customer and the respective operator.
European Commission (VIES): For businesses, Answely verifies the VAT ID via VIES. The Commission acts as an independent controller in this respect, not as a processor.
Geolocation: The country in the page statistics of answely.com is derived from a local database file on our own server. No IP address is sent to a geolocation service.
Telegram: In the event of malfunctions and for new support requests, a fixed signal without content may be sent to the operator's phone – without sender, message text, question or IP address. Since no personal data is transmitted, Telegram is not a sub-processor.
Google reCAPTCHA (Google Ireland Ltd., Dublin): Only during a disruption of the formconfirmed form protection does reCAPTCHA check the next submission of the affected form on answely.com instead (privacy policy 3.8). Google is responsible for its own processing and is not a sub-processor; visitor data from our customers' websites never reach Google this way. Comparable third-party services are not used.

4. Changes to this list

Answely engages sub-processors on the basis of the general authorisation in the Data Processing Agreement. Before a new sub-processor begins processing or an existing one is replaced, Answely informs customers at least 30 days in advance by email to the account address. Within this period, the customer may object on legitimate data protection grounds; if the objection cannot be resolved, the customer may terminate the affected service.

Purely technical entries without personal data processed on behalf (such as certification authority or registrar) are updated without advance notice and recorded here.

5. Status and version

Version 1.0, as of 18.10.2026 – first published version; version 1.1, as of 31.10.2026: formconfirmed added in section 3.

This English version is the binding version; translations are provided for information.