List of Subprocessors

This page lists the providers that SOLIDPULSE LABS, SL ('Business Copilot') uses to provide Business Copilot and that may process personal data. We distinguish between: (i) subprocessors that process the Customer's End Users' data on the Customer's behalf (a processing relationship governed by the DPA, Annex III); and (ii) providers that process the Customer's portal account data, for which Business Copilot is the Controller (governed by the platform Privacy Policy).

Business Copilot imposes on each subprocessor, by contract, data protection obligations equivalent to those of the DPA, and remains fully liable to the Customer for their compliance.

• Google Cloud EMEA Limited (Ireland) — Cloud infrastructure for the Service. Location: European Union. Safeguard, for any access from outside the EEA: EU-US Data Privacy Framework and Standard Contractual Clauses.
• Cloudflare, Inc. (USA) — Delivery and protection of the Service's web traffic. Location: global network, with possible processing outside the EEA. Safeguard: EU-US Data Privacy Framework and Standard Contractual Clauses.

In addition to the above, these providers process the data of portal account holders and Authorized Users (not End User data):

• Stripe Payments Europe, Limited (Ireland) — Payments and billing. Location: EU / USA. Safeguard: EU-US Data Privacy Framework and Standard Contractual Clauses.
• Google Ireland Limited — Email for portal notices. Location: European Union.

OpenAI (artificial intelligence): the Service's AI features use the OpenAI API key that the Customer itself configures in its workspace. OpenAI is not a subprocessor of Business Copilot: it is a provider contracted directly by the Customer, under its own account and terms (including its data processing). When the Customer uses AI, the necessary content (e.g., meeting transcripts or texts to analyze) is sent to OpenAI with that key. Without a configured key, the Service sends no data to OpenAI; the Customer can remove it at any time.

Connectors (Gmail, Google Calendar, Google Drive, HubSpot, Jira, and GitHub): they are connected with the Customer's own accounts and at its initiative; those providers process the data under their relationship with the Customer.

This list is maintained as the current published version. Business Copilot will inform of the addition or replacement of subprocessors with reasonable advance notice, giving the Customer the opportunity to object on reasonable data protection grounds (DPA cl. 6).