Sub-processors
Last updated: July 2026
This page lists the third parties that Privas Intelligence Ltd ("Privas AI") engages to process personal data when providing the Privas AI platform.
We publish this list because our customers are data controllers and cannot meet their own transparency obligations without knowing who stands behind us. This page is incorporated by reference into our Privacy Policy and into every Data Processing Agreement we sign.
1. How to read this page
Privas AI processes two distinct populations of personal data, and the sub-processors differ between them:
- Customer data — the account holders who sign up for Privas AI. Privas AI is the controller of this data.
- End Visitor data — people who chat with a customer's AI assistant on the customer's website. The customer is the controller; Privas AI is a processor acting on the customer's instructions.
The "Data processed" column below states which population is affected.
2. Infrastructure sub-processor
All data that Privas AI stores itself — chat transcripts, knowledge graphs, the account registry, and real-time message delivery — is held on infrastructure that Privas AI operates directly. We do not use a managed database service, a managed vector database, or a third-party chat-infrastructure vendor.
| Sub-processor | Role | Data processed | Location |
|---|---|---|---|
| Contabo Asia Private Limited | Virtual private server hosting. Runs all Privas AI application containers, the Neo4j knowledge/transcript databases, the PostgreSQL registry, and the Soketi real-time server. | Customer data and End Visitor data | Singapore |
Because the Neo4j databases, the PostgreSQL registry, and the real-time server are self-hosted by Privas AI on this infrastructure, Neo4j Inc., the PostgreSQL project, and the Soketi project are not sub-processors — they are software we run, not services we send data to. Privas AI does not use Pusher Channels or any other hosted real-time provider.
3. Artificial intelligence sub-processors
These providers receive the content of conversations. This is inherent to how the product works: an AI assistant cannot answer a question without the question being sent to a language model.
| Sub-processor | Role | Data processed | Location |
|---|---|---|---|
| Anthropic PBC | Primary language model (Claude Haiku 4.5). Generates assistant replies, detects intent, rephrases questions, composes follow-up messages and emails, and extracts entities from uploaded documents. | End Visitor data — the full text of visitor messages, conversation history, retrieved knowledge-base passages, and system prompts. Customer data — the text of uploaded knowledge sources. | United States |
| OpenAI, L.L.C. | Text embeddings (text-embedding-ada-002) used to index knowledge sources and to match visitor questions against them; a secondary model (gpt-4o-mini) used for evidence selection and onboarding setup; a legacy model (gpt-3.5-turbo) used by the image branch of the embed widget. | End Visitor data — every retrieval query. Customer data — every passage of every uploaded knowledge source. | United States |
Model training and provider terms. Privas AI does not train, fine-tune, or otherwise use customer or End Visitor data to build or improve machine-learning models.
The two providers above are used through their standard published API terms. Privas AI has not negotiated a private data processing addendum, a zero data retention arrangement, or an enterprise agreement with either of them, and therefore has no commitments from them beyond what they publish and apply to all API customers. Those published terms may be changed by the provider without reference to us.
Under standard API terms a provider may retain submitted content for a limited period for safety and abuse-monitoring purposes, even where it does not use that content to train models. We have no ability to disable this.
Customers evaluating this arrangement should review each provider's published terms directly. We will supply the current versions on request, and will discuss a zero-retention arrangement where a customer requires one — see clause 7.4 of our Data Processing Agreement.
4. Platform sub-processors
| Sub-processor | Role | Data processed | Location |
|---|---|---|---|
| Clerk, Inc. | Authentication and identity for customer accounts, including social sign-in via Google. Holds credentials and session state. | Customer data — email address, authentication credentials, sessions | United States |
| Stripe, Inc. | Subscription billing and payment processing. Card details are collected and held by Stripe and never reach Privas AI systems. | Customer data — email address, subscription and payment status | United States and Ireland |
| Uploadcare, Inc. | Storage and delivery of images uploaded by customers (assistant avatars, domain icons, blog images). | Customer data — uploaded image files | United States |
| Spacemail | Outbound transactional email delivery for the platform's default mail configuration. | Customer data and End Visitor data — recipient email addresses and message bodies, which may include conversation summaries | See note below |
| Google LLC | Google Analytics 4 across privas.ai, including the chat surfaces. Also acts as an identity provider when a customer chooses Google sign-in via Clerk. | Customer data — page views and dashboard usage. End Visitor data — because the chat widget and share-link chat pages are served from privas.ai, Google Analytics also loads within them, so Google receives page views generated when a visitor opens an assistant. Conversation content is never sent to Google. | United States |
Note on the chat widget: the assistant embedded on a customer's website runs in a frame served by privas.ai and therefore inherits the site-wide Google Analytics tag. Google receives the fact that a chat surface was loaded; it does not receive message content. We consider this broader than it needs to be and are removing Google Analytics from the visitor-facing chat surfaces — until that change ships, this page describes the position accurately rather than the position we intend.
5. Customer-controlled recipients
The following are not Privas AI sub-processors. They are third parties that a customer chooses to connect, and the customer is responsible for the relationship, for the terms governing it, and for any onward transfer.
| Recipient | When data is sent | Data sent |
|---|---|---|
| MCP tool servers registered by the customer | When the customer enables an external tool integration and the assistant determines a visitor's question requires it | The tool arguments the model derives from the visitor's message — for example a currency amount or an insurance parameter — sent to the URL the customer registered, authenticated with the credential the customer supplied |
| The customer's own SMTP server | When the customer configures their own mail server instead of the platform default | Recipient email addresses and message bodies |
If you are a website visitor and want to know whether a particular assistant uses external tools, ask the organisation operating that assistant.
6. International transfers
Privas AI is registered in England and Wales, operates from Jakarta, Indonesia, and hosts its infrastructure in Singapore. Personal data is therefore transferred internationally in the ordinary course of providing the service.
- Transfers of UK and EEA personal data to sub-processors outside the UK/EEA rely on the UK International Data Transfer Addendum or Standard Contractual Clauses, together with the transfer terms in each provider's own data processing terms.
- For Indonesian data subjects, transfers are made in reliance on the cross-border provisions of Law No. 27 of 2022 on Personal Data Protection.
The practical position, stated plainly: a message sent to a Privas AI assistant is stored in Singapore and processed by language model providers in the United States.
7. Changes to this list
We will update this page before adding a new sub-processor that processes End Visitor data. Customers with a signed Data Processing Agreement may object to a new sub-processor on reasonable data-protection grounds as set out in that agreement.
To be notified of changes, email [email protected] and ask to be added to the sub-processor notification list.
About Privas AI
Privas AI is a privacy-first AI assistant platform designed to help organizations deploy conversational AI representatives on their websites.
The platform uses domain-scoped knowledge retrieval to ensure that AI responses are generated only from authorized knowledge sources.
Learn more about Privas AI:
- Privacy Policy: https://privas.ai/privacy
- Terms of Service: https://privas.ai/terms
- Documentation: https://privas.ai/documentation
Contact
For questions about this page, or to request a Data Processing Agreement:
Privas Intelligence Ltd Email: [email protected] Website: https://privas.ai Registered in England and Wales, company number 17195166 Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom Operations: Jakarta, Indonesia