To deliver the Kanal Service, we rely on a number of trusted third-party providers (“sub-processors”) who may process personal data on our behalf. We require all sub-processors to comply with the General Data Protection Regulation (GDPR) and to provide appropriate safeguards for international transfers where applicable.
The list below reflects the sub-processors currently engaged. We will notify customers of any material change to this list (addition or replacement of a sub-processor) via email or in-app notification with reasonable advance notice, allowing customers to object to the change as set out in our Data Processing Agreement.
Current sub-processors
| Sub-processor | Service provided | Location | Safeguard |
|---|---|---|---|
| Meta Platforms Ireland Ltd. | WhatsApp Business Cloud API | Ireland | EU controller / GDPR compliant |
| Shopify International Ltd. | E-commerce platform integration (orders, products, customers) | Ireland / Canada | DPA + SCCs |
| 360dialog GmbH | Alternative WhatsApp Business Solution Provider | Germany | EU controller |
| Stripe Payments Europe Ltd. | Payment processing and billing | Ireland (EU customers) | DPA + SCCs |
| OpenAI, L.L.C. | AI features (embeddings, chat completions) | United States | EU-US Data Privacy Framework + SCCs |
| HubSpot Ireland Ltd. | CRM integration | Ireland / United States | DPA + SCCs |
| Klaviyo, Inc. | Marketing data sync (segments, events) | United States | EU-US Data Privacy Framework + SCCs |
| Gorgias Inc. | Helpdesk integration | United States | DPA + SCCs |
| Attio Ltd. | CRM sync | United Kingdom | UK adequacy decision |
| Functional Software, Inc. (Sentry) | Error monitoring and observability | United States | EU-US Data Privacy Framework + SCCs |
| Pusher Ltd. | WebSocket realtime infrastructure | United Kingdom / United States | UK adequacy + SCCs |
| Loops, Inc. | Transactional and marketing email delivery | United States | EU-US Data Privacy Framework + SCCs |
| FirstPromoter, Inc. | Affiliate program tracking | United States | SCCs |
| Hetzner Online GmbH | Application server hosting (API, app, workers) | Germany | EU controller |
| Amazon Web Services EMEA SARL | SQS, S3 (eu-central-1), Lambda, Secrets Manager | EU (Frankfurt, Paris) | AWS DPA + EU regions |
| Zilliz Inc. (Milvus) | Vector database for AI features | United States (GCP us-west1) | SCCs |
| Cloudflare, Inc. | CDN, DNS, DDoS protection | Global (anycast) | DPA + SCCs |
| Google Ireland Ltd. (Workspace) | Internal email and document collaboration | Ireland | DPA + SCCs |
International transfers
Where personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, namely: (i) the EU-US Data Privacy Framework certification of the recipient, where available; (ii) Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914); or (iii) an adequacy decision applicable to the recipient country (e.g., United Kingdom, Switzerland).
Contact
For any question relating to our sub-processors, the safeguards in place, or to request a copy of our Data Processing Agreement, please contact privacy@getkanal.com.