Subprocessors
Last updated: November 5, 2026.
This list covers only the web platform (app.mail-vex.com). It is separate from the extension and licensing backend's sub-processor list, already published in the privacy policy §4.
| Sub-processor | GDPR role | Location / region | What merchant data it processes | Purpose |
|---|---|---|---|---|
| Hetzner Online GmbH | Processor (infrastructure sub-processor) | Germany, Nuremberg (European Union) | All stored content: emails, HTML, metrics, drafts, account data | Hosting the platform's database and service |
| OpenAI | Processor (AI text generation sub-processor) | United States. Traffic today goes through OpenAI's global endpoint, with OpenAI's DPA and standard contractual clauses (SCC) as the transfer mechanism — the EU data residency endpoint (eu.api.openai.com) exists but is not enabled yet for this account | The email/voice-profile content needed to draft an email, after emails and phone numbers are masked | Generating email drafts |
| Amazon Web Services, Inc. (Amazon SES) | Processor (transactional email sub-processor) | United States, EU region for storing sent messages | Only the merchant's own account email and the content of the platform's 4 transactional emails (sign-in link, payment failure notice, retention notice, account deleted notice). Never their marketing campaign content or their own subscribers' data | Sending the merchant's account transactional emails on the platform |
| Stripe, Inc. | AutomatLabs' data processor for the charge, and independent controller for its own legal purposes (not a sub-processor under this agreement — payment data is not the merchant's content) | United States / Ireland, depending on the flow | Buyer's email, card data and Pro subscription data | Processing the Pro subscription payment |
1. Hetzner
Official source: Data Protection at Hetzner, <https://docs.hetzner.com/general/company-and-policy/data-protection-at-hetzner>. The processing agreement ("AVV"/DPA) is concluded from Hetzner's customer account portal. The platform's server is in Nuremberg, Germany (European Union); Hetzner also offers US and Singapore locations, which are not used for this service.
2. OpenAI
Official source: OpenAI's business-data privacy page, <https://openai.com/business-data/>, and Data Processing Addendum, <https://openai.com/policies/data-processing-addendum/>. By default, OpenAI does not use data sent to the API to train or improve its models, and offers a case-by-case approved zero data retention (ZDR) option. An EU data residency option exists for the API (eu.api.openai.com), but the account AutomatLabs uses today does not have it enabled: traffic goes through the global US endpoint, with OpenAI's standard DPA and standard contractual clauses (SCC) as the transfer mechanism. Enabling EU residency remains a future improvement, not something in effect today.
3. Amazon SES
Official source: AWS GDPR Data Processing Addendum (DPA), <https://docs.aws.amazon.com/whitepapers/latest/navigating-gdpr-compliance/aws-data-processing-addendum-dpa.html>. AWS's DPA incorporates standard contractual clauses (SCCs) for transfers outside the EU and applies automatically to all customers who need it. The platform's email service only starts with an EU storage region.
4. Residual risk: US CLOUD Act
OpenAI and Amazon are US-headquartered companies, even when they store data in an EU region. There is a theoretical risk that a US order (CLOUD Act) could reach that data even while hosted in Europe — a documented, unresolved risk, not fixed by the DPA or by EU residency. It does not apply to Hetzner, a German company without that exposure for the European service.