Sub-processors
To provide the service, PrivatAI uses the sub-processors listed below. A data processing agreement (DPA) under Art. 28 GDPR is in place with each; for providers outside the EU, the EU Standard Contractual Clauses (SCCs, Implementing Decision (EU) 2021/914) apply.
Controller: Artur Parutkin (sole proprietorship), Hamburg. Data-protection contact: datenschutz@privatai.com — address see imprint.
Core data stays in the EU. Your prompts and documents are processed exclusively in the EU (inference in France, hosting in Germany) and are not stored. Ancillary data (email, payment) may be processed via US providers — safeguarded by EU Standard Contractual Clauses.
Sub-processors in use
Scaleway S.A.S.
PurposeAI inference (running the language models)
DataPrompts and outputs — not stored, not logged, no training
LocationFrankreich (EU)
TransferDPA Art. 28; no third-country transfer
Hetzner Online GmbH
PurposeHosting, servers, database
DataAccount, usage and platform content data
LocationGermany (EU)
TransferDPA Art. 28; EU/EEA only
Resend (Plus Five Five, Inc.)
PurposeTransactional and newsletter email
DataEmail addresses, names, email content
LocationUSA
TransferDPA + EU Standard Contractual Clauses (2021/914)
Stripe Payments Europe, Ltd.
PurposePayment processing
DataPayment, billing and identity data (KYC)
LocationIreland (EU); possibly US affiliates
TransferDPA + EU Standard Contractual Clauses
T-Systems International GmbH (Telekom) German-hosting tier only
PurposeAI inference with German hosting (EU models only, T-Cloud Public)
DataPrompts and outputs — not stored, no training
LocationGermany (EU)
TransferDPA (EU SCC Art. 28, 2021/915); EU models only
Further notes
Web analytics run on a self-hosted instance (GoatCounter) on our EU infrastructure — no separate sub-processor, no third-party trackers, no cookies.
We inform affected customers of intended changes to this list (adding or replacing a sub-processor) with reasonable advance notice and grant a right to object.
Last updated: July 2026