Legal · for stores

Sub-processors

Last updated: 27 October 2026

When a store uses GroceryAI, the store is the controller of its customers’ data and Aequus Ventures SRL is the processor, under the data processing agreement. To provide the service we rely on the providers below (sub-processors). Each one processes data only for its part of the service, under a data processing agreement.

Who processes the data of stores and their customers

  • Supabase

    What it does:
    Database, portal sign-in and service functions.
    Which data:
    All service data: catalog, conversations, carts and orders of the stores' customers, portal accounts, logs.
    Where:
    Database in the eu-north-1 region, in Stockholm (Sweden, EU). Functions run in the region closest to the caller; the portal asks for Frankfurt (eu-central-1).
    Safeguards:
    Data processing agreement with the Standard Contractual Clauses.

  • OpenAI

    What it does:
    The model that reads the conversation and writes the replies.
    Which data:
    The conversation messages (including photos and voice messages) and the catalog data needed for the reply. Not used to train models.
    Where:
    United States. The assistant's requests are sent without stored state (store: false); abuse-monitoring logs are kept for at most 30 days.
    Safeguards:
    Data processing addendum with the Standard Contractual Clauses.

  • Meta Platforms (WhatsApp Business Platform, Cloud API)

    What it does:
    Delivers WhatsApp messages between the store and its customers.
    Which data:
    Phone number, WhatsApp profile name, messages.
    Where:
    Meta data centers; keeps messages for at most 30 days.
    Safeguards:
    Meta acts as a data processor; for transfers, the WhatsApp data transfer addendum for the European Region.

  • Vercel

    What it does:
    Hosts the website and the store portal.
    Which data:
    The portal pages that the store's people open (masked conversations included) and session data.
    Where:
    Server functions in Frankfurt (Germany), pages from its worldwide network; primary processing facilities in the United States.
    Safeguards:
    Standard Contractual Clauses (Decision 2021/914).

  • Cloudflare

    What it does:
    Traffic to groceryai.ai (website and portal) passes through its network, which protects and routes it.
    Which data:
    IP addresses and traffic of the website and the portal.
    Where:
    Worldwide network, including outside the European Economic Area.
    Safeguards:
    Data processing addendum with the Standard Contractual Clauses; EU-U.S. Data Privacy Framework.

  • Resend

    What it does:
    Sends the service emails: the codes and links to sign in to the portal and, for stores that choose it, orders by email.
    Which data:
    Recipient email address; for orders, the order and delivery details.
    Where:
    United States (Amazon Web Services infrastructure).
    Safeguards:
    Standard Contractual Clauses (Decision 2021/914); EU-U.S. Data Privacy Framework.

  • n8n

    What it does:
    Service automations: the WhatsApp channel of the stores connected through n8n (today the first store) and the daily quality check of the conversations.
    Which data:
    Messages and conversations of those stores.
    Where:
    Frankfurt (Germany).
    Safeguards:
    Data processing agreement.

  • Google (Google Workspace)

    What it does:
    Aequus Ventures' email (Gmail) and video calls (Google Meet); the sheet of the daily quality check (Google Sheets).
    Which data:
    Emails exchanged with stores; in the quality-check sheet, short excerpts of the first store's conversations.
    Where:
    United States and Google's worldwide network.
    Safeguards:
    Standard Contractual Clauses.

Website only

This provider processes the data of people who visit the website and book a call, not the data of the stores’ customers.

  • Cal.com

    What it does:
    Booking calls from the website.
    Which data:
    Name, email and what the person booking writes in the form.
    Where:
    United States.
    Safeguards:
    Standard Contractual Clauses.

Planned, not yet active

Stripe, for the payment of store subscriptions. Today it processes no data: it joins this list, with the notice below, before it is activated.

When the list changes

Before entrusting data to a new sub-processor, or changing where one of them processes it, we update this page and tell the owner of every store by email at least 30 days in advance. The store can object on data protection grounds by writing to hello@groceryai.ai; if we cannot find a solution, it can terminate the agreement without penalty.