Sub-Processors
Last Updated: April 2026
This page lists the third-party sub-processors that WORKSJO LTD (trading as Chatloom) engages to process personal data on behalf of our customers. We maintain this list as part of our commitment to transparency under the UK GDPR and EU GDPR.
🔒 International Transfers: All transfers to sub-processors outside the UK and EEA are protected by Standard Contractual Clauses (SCCs) approved by the UK ICO and the European Commission.
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Anthropic | AI language model processing (Claude) | Chat messages, system prompts | United States |
| OpenAI | AI language model processing (GPT) and text embeddings | Chat messages, system prompts, knowledge-base text for embeddings | United States |
| AI language model processing (Gemini) | Chat messages, system prompts | United States | |
| Cohere | AI reranking for search relevance | Search queries, document snippets for reranking | United States / Canada |
| Meta Platforms | Messaging channels (WhatsApp, Instagram, Messenger) | End-user messages and media, profile name, channel identifiers | United States |
| Shopify | E-commerce integration for connected merchant stores | Product catalog, order and customer data of the connected store | Canada / United States |
| Vercel | Application hosting, serverless compute, and file (Blob) storage | Application data in transit, request logs, uploaded files (logos/images) | European Union (Frankfurt) |
| Supabase | Primary database and vector store | Account data, conversations, training documents, knowledge base | European Union (Stockholm) |
| Clerk | User authentication and identity management | Email, name, OAuth tokens, session data | United States |
| Stripe | Payment processing and billing | Billing details, subscription data | United States |
| Upstash | Redis caching and rate limiting | Session identifiers, rate limit counters | European Union |
| Resend | Transactional email delivery | Email addresses, email content | United States |
| Sentry | Error monitoring and session replay (consent-gated) | Error logs, stack traces, session replay data (when consented) | United States |
| Google Analytics | Website usage analytics (consent-gated) | Page views, navigation events, anonymized usage data | United States |
| Microsoft Clarity | Product analytics and session replay (consent-gated) | Usage events, masked session recordings (when consented) | United States |
Changes to Sub-Processors
We will notify customers of any new sub-processors at least 30 days before they begin processing data. You may object to a new sub-processor by contacting us within 14 days of notification.
Questions?
For questions about our sub-processors or data processing, contact us at support@chatloom.app