This page forms Annex III to the Data Processing Agreement. Advigator engages the sub-processors below to provide the Services. Under the DPA, each Sub-processor must be bound by appropriate written data protection obligations before processing Customer Personal Data, and Advigator remains responsible for its performance.
Scope. Only providers processing Customer Personal Data on the Customer’s behalf are Sub-processors under the DPA. Other providers are listed separately for transparency.
Change notification. We give at least 30 days’ notice before adding or replacing a sub-processor, to the customer contact specified in the DPA. Optional public updates can be requested at legal@advigator.com with the subject “subscribe: sub-processor notices”. Customers may object under clause 6.3 of the DPA.
1. Infrastructure and hosting
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| DigitalOcean, LLC | Production hosting | Customer Data | United States |
| Cloud66 Ltd | Infrastructure management and backups | Administrative metadata and Customer Data | United Kingdom; backup storage in the United States |
| Amazon Web Services, Inc. | Backups and advertising event delivery | Customer Data and advertising events | United States and European Union |
Transfer safeguards are governed by clause 12 of the DPA and agreements with the actual recipients. Country and provider names do not by themselves prove that a particular transfer instrument or certification applies. Relevant safeguards can be requested at legal@advigator.com.
2. Application services
| Sub-processor | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| Cloudflare, Inc. | CDN, DNS, WAF and bot protection (Turnstile) for the website and dashboard | Connection metadata, IP addresses, request headers | Global edge network; contracting entity in the United States | EU SCCs, plus EU Data Privacy Framework certification |
| Stripe, Inc. / Stripe Payments Europe Ltd | Subscription billing, payment processing and invoicing | Billing contact details, company name, VAT or tax identification number, payment method token, invoice history. Advigator never receives or stores full card numbers. | Ireland and United States | EU SCCs, plus EU Data Privacy Framework certification |
| Postmark (ActiveCampaign, LLC) | Transactional email — account, security, billing and notification messages | Recipient email address, message content, delivery and bounce events | United States | EU SCCs, plus EU Data Privacy Framework certification |
| Intercom, Inc. | Customer support messaging and help centre | Name, email address, account identifiers, support conversation content | United States and Ireland | EU SCCs, plus EU Data Privacy Framework certification |
| PostHog, Inc. | Product analytics — how the dashboard is used, to find defects and improve the product | Authenticated user identifier and email address, page and feature usage events | European Union (EU Cloud) | Not applicable (EEA) |
| Functional Software, Inc. (Sentry) | Application error monitoring and diagnostics | Error traces, which may incidentally contain user identifiers, email addresses, IP addresses and request parameters | United States | EU SCCs, plus EU Data Privacy Framework certification |
| Honeybadger Industries LLC | Application error and uptime monitoring | Error traces and request metadata, which may incidentally contain user identifiers | United States | EU SCCs |
3. Artificial intelligence
The targeting agent sends product and keyword data to large language models to propose advertising targets. See the AI Transparency Notice for what is sent, what is not, and how to switch the feature off.
| Sub-processor | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| OpenRouter, Inc. | AI request processing | Product and search information and related instructions; free text may incidentally identify a person | United States | Actual executed safeguards and recipient configuration require confirmation before restricted transfers |
| Model providers reached through OpenRouter — currently DeepSeek, Alibaba Cloud (Qwen), Tencent (Hunyuan) and Xiaomi (MiMo) | Inference for the targeting agent | As above | United States and People’s Republic of China, depending on the provider and the routing in force at the time | See the safeguards and verification note below |
AI provider note. OpenRouter routes requests to inference providers; a listed model developer is not necessarily the actual recipient. The names above identify the current model families, not a verified exhaustive list of hosting entities. Processing may occur in the United States and China. Product titles and search phrases can contain personal information. The actual recipient entities, retention and lawful transfer safeguards must be established before Customer Personal Data is sent. Contact legal@advigator.com to confirm the approved configuration; no country restriction or zero-retention setting is implied by this register.
4. Independent business operations
| Sub-processor | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| Partnero, Inc. | Administration of the affiliate and referral programme | Affiliate contact details, referral attribution | United States | EU SCCs |
| iubenda s.r.l. | Consent and cookie preference management on the website | Consent records, pseudonymous identifiers | Italy | Not applicable (EEA) |
These providers support Advigator’s own controller activities and are not automatically appointed as Customer Sub-processors. The same distinction applies to payment processing and account/support administration above. Processing Customer content solely on its behalf remains subject to the DPA.
5. Marketing website only
The following services operate on advigator.com (the public marketing site) and never receive Customer Data from the dashboard: Meta Platforms (advertising conversion measurement), Reddit (advertising conversion measurement), OpenAI (advertising conversion measurement), Partnero (referral attribution), Kit / ConvertKit (newsletter), Calendly (meeting booking) and Airtable (affiliate application form). They are described in the Privacy Policy and are governed by the Cookie Policy, not by the Data Processing Agreement.
6. Not sub-processors
Amazon Advertising and the Amazon marketplaces are not Advigator sub-processors. They are the Customer’s own service providers: the Customer holds the advertising account, authorises Advigator to access it, and can revoke that authorisation at any time. Advigator acts on the Customer’s instruction against those accounts under the Amazon Ads API terms and Partner Network Policies.
Contractual notices go to the designated customer legal/privacy contact or account administrator, regardless of whether the customer subscribes to public updates.
Change log
| Date | Change |
|---|---|
| 18 September 2026 | First publication of the sub-processor list. |