Legal
Sub-processors
Last updated October 2026
These are the service providers that process personal data for Zyberon: what each one does, the data it receives and where that data is processed. This page is Annex IV of our Data Processing Agreement.
01How we use sub-processors
We engage a sub-processor only when the Service needs it, under a written contract that protects personal data at least as well as our Data Processing Agreement, and we send each one only the data its task needs. The servers that hold your data are in the European Union.
Some providers, in particular the AI providers, process data in the United States. Such transfers rely on an adequacy decision, such as the EU-US Data Privacy Framework, or on the standard contractual clauses of the European Commission, as applicable to each provider.
02Current sub-processors
Hosting and infrastructure
Hetzner Online GmbH
- Purpose:
- Servers for the web application, the database, file storage, background processing, backups and build pipelines.
- Data:
- All data held in the Service.
- Location:
- Germany and Finland (EU)
Contabo GmbH
- Purpose:
- A server our engineering team uses to build, test and operate the Service, with administrative access to the production systems.
- Data:
- Data that is read while the Service is operated and supported.
- Location:
- Germany (EU)
Cloudflare, Inc.
- Purpose:
- Delivery and protection of the custom tracking domains of stores, and bot protection on sign up and sign in.
- Data:
- IP address, browser details and the tracking events that pass through a custom domain.
- Location:
- Global network; Cloudflare, Inc. is based in the United States
AI processing
OpenAI
- Purpose:
- Text and image generation.
- Data:
- The content of a task: prompts, store and product details, customer messages when you use the support tools, and images.
- Location:
- United States
Anthropic PBC
- Purpose:
- Text generation, and AI assisted engineering and operations, including the analysis of error reports.
- Data:
- The content of a task, and error details that can contain workspace data.
- Location:
- United States
Google (Gemini)
- Purpose:
- Text and image generation, and image analysis, with the Gemini models.
- Data:
- The content of a task: prompts, store and product details, customer messages when you use the support tools, and images.
- Location:
- United States and other Google locations
Higgsfield AI
- Purpose:
- Video and image generation.
- Data:
- Prompts, product images and the media that is generated.
- Location:
- United States
Payments, email and operations
Mollie B.V.
- Purpose:
- Subscription payments.
- Data:
- Name, email address, payment details and payment status of the account holder.
- Location:
- Netherlands (EU)
Resend
- Purpose:
- Email from Zyberon itself, such as invitations, notifications and service messages.
- Data:
- Recipient email address and the content of the message.
- Location:
- United States
Slack Technologies
- Purpose:
- Our internal operational alerts, and notifications to our sales team about new sales enquiries.
- Data:
- Error and alert details, and the name, company, email address and phone number of people who ask us for a sales call.
- Location:
- United States
Our own sales and marketing
Calendly LLC
- Purpose:
- Booking sales calls from our own website.
- Data:
- Name, email address and the details given when booking.
- Location:
- United States
Meta Platforms Ireland Ltd.
- Purpose:
- Measuring our own advertising on our campaign pages, only after a visitor accepts tracking. Meta and Zyberon are joint controllers for this collection.
- Data:
- Hashed contact details, IP address, browser details and Meta cookie identifiers.
- Location:
- Ireland (EU) and the United States
Research data
Apify Technologies s.r.o.
- Purpose:
- Collecting public web pages and public ad library data for the research features.
- Data:
- Publicly available content, which can show or name people.
- Location:
- Czech Republic (EU) and the United States
DataForSEO
- Purpose:
- Keyword and search data for the SEO features.
- Data:
- Search terms and website addresses. No personal data is sent by design.
- Location:
- Not applicable: no personal data is sent
Proxy4U
- Purpose:
- Network exit for collecting public web pages.
- Data:
- Encrypted connections to public websites, whose content the provider cannot read.
- Location:
- Not applicable: no readable personal data
03Services you connect yourself
When you connect one of these services to your workspace, we exchange data with it on your instructions. They are not our sub-processors: your own agreement with each provider governs what it does with the data.
Shopify
Your store: products, orders and customers, and the changes you ask the Service to make.
Meta (Facebook, Instagram)
Your ad accounts, conversion events through the Conversions API, and messages and comments on Messenger and Instagram.
Google (Gmail, Google Ads, Search Console)
Your support mailbox, your Google Ads account and your Search Console data.
Microsoft (Outlook)
Your support mailbox.
IMAP and SMTP
Your own mail server, when you connect a mailbox with IMAP and SMTP.
Klaviyo, Mailchimp
Profiles, events and subscriptions in your own email marketing account. Klaviyo receives email addresses and phone numbers in readable form, because it has to match each event to a profile.
Slack
Notifications to your own Slack workspace.
17TRACK
Parcel tracking numbers, when you connect your own 17TRACK account.
OpenAI, Anthropic, Google, Higgsfield, DataForSEO
Requests made with your own API key or account, which run under your own agreement with that provider.
04Changes to this list
We tell the owner of every workspace by email at least 30 days before a new sub-processor starts processing personal data, and we update this page at the same time.
You can object to a new sub-processor on reasonable data protection grounds within that period by writing to hello@zyberon.ai. Our Data Processing Agreement describes what happens next.
Questions about this document? Email hello@zyberon.ai.