Subprocessors
Last updated: 30.09.2026
About this page
1.1 This page lists the sub-processors that conclusia GmbH ("conclusia") engages to process personal data contained in Customer Data on behalf of its customers when providing the conclusia service. It forms Annex 3 of the Data Processing Agreement (www.conclusia.io/legal/data-processing-agreement, the "DPA"). Terms defined in the DPA and in the Terms of Service (www.conclusia.io/legal/terms-of-services) have the same meaning here.
1.2 The page also lists, in separate sections and for transparency only, recipients that are not sub-processors: the Data Providers from which conclusia retrieves business data on the Customer's instruction, the service providers conclusia uses for its own purposes as a controller, and the third parties from which the web application loads content directly in the user's browser.
1.3 For each recipient outside the European Economic Area, the table states the transfer mechanism under Art. 44 ff. GDPR. "DPF" means the EU-U.S. Data Privacy Framework (adequacy decision of 10 July 2023), which applies only where the recipient is certified and the transfer falls within the certification. "SCCs" means the Standard Contractual Clauses of Commission Implementing Decision (EU) 2021/914, in place either between conclusia and the sub-processor (module 3, processor to processor) or between the sub-processor and its onward recipient, as stated in each row (DPA section 11.2).
Sub-processors for Customer Data
No.
Sub-processor
Service
Customer Data concerned
Location and transfer mechanism
2.1
Amazon Web Services
Hosting and compute; databases, file storage and search indexes; conversation memory; sending of emails (Amazon SES); AI inference through Amazon Bedrock with models of Anthropic, Amazon and DeepSeek that run inside AWS. The model vendors receive no Customer Data.
All Customer Data
EU (Frankfurt; for AI inference also other EU regions) and USA (Northern Virginia, Ohio and, for AI inference, other US regions). AI inference may be routed by AWS to AWS regions worldwide (cross-region inference). Mechanism: DPF and SCCs in the AWS data processing addendum.
2.2
OpenAI (direct API at api.openai.com)
Language models for the agent that answers research questions and for the agent that reads and summarises company websites
Research questions, company names and web addresses, content of the web pages retrieved for the question, and, for research questions on contacts, the contact data retrieved for them
USA. Mechanism: DPF where the contracting entity is certified, otherwise SCCs.
2.3
Google (Gemini Developer API)
Search-grounded research by the assistant
Search queries that the assistant derives from the Customer's brief
USA and other locations of Google's infrastructure. Mechanism: DPF where the contracting entity is certified, otherwise SCCs in Google's data processing terms.
2.4
Alibaba Cloud (Model Studio, DashScope international endpoint)
Text embeddings used to group companies into segments and to compare companies
Search strings derived from the Customer's brief; profile text of companies
Singapore. Mechanism: SCCs, with a transfer impact assessment.
2.5
Tavily
Web search and retrieval of publicly available information about companies
Search queries derived from research questions and company names; web addresses of companies to be retrieved
USA. Mechanism: DPF where the contracting entity is certified, otherwise SCCs.
2.6
Google (Google Workspace)
Email and support communication: the mailboxes support@conclusia.io, privacy@conclusia.io and kontakt@conclusia.io
Content of emails sent to or from these addresses, including instructions, support and data protection requests, and any Customer Data that users include in them
USA and other locations of Google's infrastructure. Mechanism: DPF where the contracting entity is certified, otherwise SCCs in Google's data processing terms.
Data Providers (independent controllers)
3.1 Where the Customer's Plan includes them and the Customer selects them for a research column, conclusia queries the following Data Providers on the Customer's instruction (DPA section 8). Each is an independent controller for the data it holds and discloses. They are not sub-processors: they do not process Customer Data on conclusia's behalf. conclusia sends them only data identifying the company concerned, such as its name, web domain or register number. Data from Data Providers is not included in the free plan.
Data Provider
Data provided
Location
Hunter (Hunter Web Services, Inc., 2810 N Church St #50754, Wilmington, Delaware 19802, USA)
Business contact data of people at a company: name, position, business email address, telephone number, links to professional profiles, with source
Servers in Belgium (EU); transfers outside the EEA under Standard Contractual Clauses (Hunter privacy policy)
openregister (openregister.de)
Data from the German commercial register, including representatives and shareholders of a company
Germany
3.2 Data returned by a Data Provider becomes Customer Data once retrieved and stays with the Customer's list. conclusia also keeps it in a cache separate for each Customer. A cached response is no longer used after 30 days (the resolution of a company to its register identifier after 90 days); older entries are removed in the course of regular clean-up and at the latest when the Customer Data is deleted (DPA section 14).
conclusia's own service providers (not sub-processors for Customer Data)
4.1 conclusia uses the following providers for purposes for which it is itself the controller, as described in its Privacy Policy (www.conclusia.io/legal/privacy-policy). They act as conclusia's processors for those purposes and are listed here for transparency.
Provider
Purpose
Location and transfer mechanism
Slack Technologies Limited, Ireland
Internal channels for support, feedback and problem reports sent by users, and operational alerts
USA. Mechanism: DPF where the contracting entity is certified, otherwise SCCs.
Amazon Web Services
Hosting of account and sign-in data, security logs, usage metering, billing records, the seat check, and conclusia's Company Database
EU (Frankfurt) and USA, as in row 2.1.
Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland)
Payments, subscriptions and invoices for paid plans. For fraud prevention, AML checks and its obligations as a payment institution, Stripe acts as an independent controller
EU; transfers to Stripe, Inc. (USA) under the DPF and SCCs.
Framer (Framer B.V., Rozengracht 207B, 1016 LZ Amsterdam, Netherlands)
Hosting of the website www.conclusia.io
Hosted on Amazon Web Services (USA) and delivered through a worldwide edge network (AWS CloudFront, anycast); Framer's data processing addendum is part of its terms and uses the EU-US Data Privacy Framework and Standard Contractual Clauses (module 2)
4.2 To build the Company Database from public sources, conclusia also uses sub-processors listed in section 2 as its own processors: Google (Gemini Developer API) to process public web pages, and OpenAI and Alibaba Cloud to read and embed the public websites of companies, including websites that become known through the Service (DPA section 4.6). For this purpose they receive public website content and web addresses, and no other Customer Data.
4.3 Google (Google Workspace, row 2.6) also acts as conclusia's own processor for the emails that conclusia handles for its own purposes as a controller, in particular support, feedback, data protection requests and general enquiries to kontakt@conclusia.io.
Services loaded by the web application (independent controllers)
5.1 Some functions of the web application load content directly from third parties. The user's browser then connects to that third party, which processes the data it receives as an independent controller. These third parties are not sub-processors (DPA section 4.7).
Third party
Function
Data the browser transmits
Location
Google (favicon service)
Shows the icon of a website that the service has visited as a research source
The user's IP address and the domain of that website
USA and other locations of Google's infrastructure
CARTO (CartoDB Inc., 307 Fifth Avenue, Floor 9, New York, NY 10016, USA)
Map tiles for the map in the geographic filter
The user's IP address; no Customer Data
USA; tiles are delivered through the content delivery network of Fastly, Inc. (worldwide edge locations). CARTO is certified under the EU-US Data Privacy Framework and otherwise relies on Standard Contractual Clauses
5.2 The fonts of the web application are served from conclusia's own servers.
Not sub-processors: MCP clients
6.1 Where the Customer connects conclusia to an AI assistant through the Model Context Protocol, for example Claude by Anthropic, ChatGPT by OpenAI or Microsoft Copilot, the provider of that assistant is the Customer's own service provider and not a sub-processor of conclusia. The Customer chooses the assistant, decides what it sends to and receives from conclusia, and is responsible for its own agreement with that provider (DPA section 4.5).
6.2 OpenAI appears in section 2 only for conclusia's own use of the OpenAI API. Anthropic and Microsoft receive no Customer Data from conclusia. Models of Anthropic used by conclusia run inside Amazon Bedrock (row 2.1).
Changes to this list
7.1 conclusia informs Customers at least 30 days before a new sub-processor starts processing Customer Data, and at least 14 days before where the change is urgently needed to remedy or prevent a security incident (DPA section 10.2). The notice names the sub-processor, its service, the Customer Data concerned, its location and the transfer mechanism.
7.2 Notices are sent by email to the account owner of each Customer, to the privacy contact a Customer has named to privacy@conclusia.io, and to everyone who has subscribed to change notices; they may in addition be shown in the service. To subscribe, write to privacy@conclusia.io with the subject "Sub-processor notices".
7.3 The Customer may object to a change within the notice period as set out in DPA section 10.3.
Contact
conclusia GmbH · Straße am Flugplatz 52D · 12487 Berlin · Germany · support@conclusia.io