Every company that may process personal data from your projects is listed here, as the GDPR requires (Art. 28(2) and (4)). The product never shows which provider serves which model; this list names all of them without that mapping.
We tell customers about a new or replaced sub-processor at least 30 days before it starts processing customer data, by email to organization owners and on this page; anyone else who wants to be told can write to privacy@oneactor.com. You can object as the Data Processing Agreement describes.
Infrastructure
| Sub-processor | What it does | Where data is processed | Transfer safeguard |
|---|---|---|---|
| Amazon Web Services EMEA SARL (Luxembourg) | Hosting of the platform, workspaces and your apps; databases, storage, content delivery; transactional email | EU — AWS region eu-central-1, Frankfurt; content delivery edge locations worldwide (cached copies only) | EU entity; Amazon.com, Inc. (covering Amazon Web Services, Inc.) is on the EU–U.S. Data Privacy Framework list; AWS DPA with standard contractual clauses |
| Scaleway SAS (France) | A Mac dedicated to OneActor that builds the iPhone versions of your phone apps from your project's code | EU — Paris, France | Within the EU |
Apple and Google, where you publish your phone apps, are not on this list: you hold those developer accounts, and they work for you under your own agreements with them (Terms 5.7).
AI model providers
Content an agent is working on — your messages, code and data from your workspace — is sent to the provider serving the model at that moment. OneActor chooses the provider. An AI account your organization connects itself is not on this list: that provider works for you under your own contract with it (Terms 5.6).
| Sub-processor | Where | Training on your data | Retention at the provider | Transfer safeguard |
|---|---|---|---|---|
| OpenAI Ireland Ltd (Ireland), with OpenAI's US infrastructure | United States | No | Abuse-monitoring logs up to 30 days, unless zero retention is approved | EU contracting entity; OpenAI's onward transfers under its standard contractual clauses |
| A2 Labs, Inc. (Makora) (United States) | United States | No | Zero retention per its DPA | Standard contractual clauses in Makora's DPA, with a transfer impact assessment |
| Amazon Web Services EMEA SARL (Luxembourg), through Amazon Bedrock, for Anthropic's Claude models | EU — Bedrock's EU cross-region inference, EU regions only | No | Not stored or logged by Amazon Bedrock; Anthropic does not receive it | EU entity; AWS DPA with standard contractual clauses |
We do not use AI providers or endpoints located in China. Models developed by Chinese laboratories (at present Kimi) are run for us only by the providers above.
Payments
| Company | Role | Where |
|---|---|---|
| Link — Sold through Link, LLC, an affiliate of Stripe (United States) | Merchant of Record: sells plans and credits to you, takes the payment on a checkout page hosted by Stripe, and handles VAT, invoices and refunds, as an independent controller of your payment data | United States and other countries |
Link is listed here for transparency; for your payment data it is not our processor: Stripe and we are independent controllers of it, and Link processes it under its own privacy policy. Payments are acquired by Stripe's acquiring affiliates, Stripe Payments Company or Stripe Technology Europe, Limited.
Changes
| Date | Change |
|---|---|
| 2 October 2026 | First version |