Subprocessors List
Last Updated: May 2026
|Version 3.1
www.botvee.ai/subprocessors
Notice
Botvee uses the following third-party subprocessors to deliver our SaaS platform. All subprocessors are bound by Data Processing Agreements (DPAs) and required to implement appropriate technical and organisational security measures. Registered users receive at least 14 days' prior email notice before any new subprocessor is added or material changes are made.
Current Subprocessors
| Provider | HQ | Purpose | Data Processed | Region | Security | Privacy Link |
|---|---|---|---|---|---|---|
| Stripe, Inc. | USA / EU (Ireland) | Payment processing, billing, tax calculation | Billing name, email, transaction data | USA / EU | PCI-DSS Level 1 | stripe.com/privacy |
| Supabase, Inc. | USA | Database hosting, authentication | Account data, AI agent config, interaction logs | USA / EU (optional) | SOC 2 program | supabase.com/privacy |
| Vercel, Inc. | USA | Web hosting, global CDN edge | Technical logs, IP, request metadata | Global (edge) | SOC 2 program | vercel.com/legal |
| OpenAI, LLC | USA | AI model API — AI agent responses | Chat prompts, interaction data | USA | Contractual safeguards; no API training | openai.com/privacy |
| Email provider | TBD | Transactional emails (receipts, notifications) | Email address, name | TBD | DPA in place | Available on request |
| Analytics provider | TBD | Anonymised website usage analytics | Anonymised data only | TBD | Privacy-respecting; consent-gated | Available on request |
International Transfer Safeguards
For all transfers of EU/UK personal data to subprocessors in non-adequate countries, Botvee relies on:
- Standard Contractual Clauses (SCCs) per EU Commission Decision 2021/914, Module 2 (Controller to Processor) — signed with all relevant subprocessors
- Transfer Impact Assessments (TIAs) — conducted for each transfer to a non-adequate destination country
- Supplementary measures: AES-256 encryption, pseudonymisation, and strict access controls
- UK Transfers: UK International Data Transfer Agreements (IDTAs) or UK Addendum to EU SCCs
- Pakistan transfers: Botvee applies contractual safeguards with all international subprocessors in anticipation of PDPB 2023 enactment
Subprocessor Change Notice
Botvee will notify all registered users by email with at least 14 days' prior notice before adding a new subprocessor or making material changes to an existing subprocessor relationship. EU/UK business clients who have executed a DPA with Botvee have the right to object to new subprocessors within this notice period per GDPR Art.28(2). To exercise this right, email legal@botvee.ai — Subject: "Subprocessor Objection — [Company Name]".
Requesting Subprocessor Information
For detailed information about any subprocessor including their DPA provisions and security certifications, email legal@botvee.ai — Subject: "Subprocessor Information Request".
Contact
Legal / DPA
Company
BOTVEE (PRIVATE) LIMITED (SECP: 0326112)
Related