CHAT4U LEGAL
Subprocessors and Other Service Providers
Last updated: November 4, 2026
1. How to read this list
פרסום מי סטודיו לעיצוב גרפי והפקות דפוס בע"מ, trading as Chat4U, uses suppliers for the functions below. A subprocessor handles customer-controlled personal data for Chat4U. Other suppliers handle our account or operating data, act independently, or are selected by the customer. A supplier can have different roles for different processing.
Not every provider receives data for every customer. The enabled service, provider selection, purpose and permissions determine the relevant information. A listing does not authorize sending all data to every supplier. The DPA governs subprocessors; the Privacy Policy explains independent processing.
2. Customer-service processing suppliers
| Supplier | Function and relevant data | Location and scope |
|---|---|---|
| Amazon Web Services EMEA SARL — AWS | Hosted infrastructure, databases, object storage, operations and recovery; customer content, files, conversations, derived records and service metadata. | Primary production database and file storage are configured in Frankfurt, Germany. Applicable AWS service, support and onward processing can involve other countries, including the United States. A storage-region selection is not an all-processing location guarantee. |
| OpenAI OpCo, LLC — OpenAI API | Selected chat generation, Responses and Batch processing, owner briefings, conversation analysis and supported image/audio understanding; relevant prompts, retrieved content, conversations, permitted media, results and metadata. | United States processing and applicable disclosed supplier locations. Temporary files and provider abuse/security retention are separate from the no-training commitment. |
| Anthropic, PBC — Anthropic API | Selected model generation; relevant prompts, messages, retrieved context, results and service metadata. | United States and applicable supplier locations under the relevant commercial arrangement. |
| Jina AI GmbH, an Elastic company — Jina APIs | Embeddings and reranking; submitted text passages, search queries, rankings and related metadata. | Applicable Jina/Elastic processing locations and terms. The current Elastic arrangement governs rather than relying on a superseded pre-acquisition policy. |
| LangChain, Inc. — LangSmith | Production tracing and observability; relevant prompt/message or tool traces, metadata and errors. | The production service uses LangSmith's United States endpoint, with applicable supplier support and onward-processing locations. Tracing is a separate content-copy and retention path, not automatically content-free or confined to the primary database's region. |
| Bright Data Ltd. — proxy services | Supported source-access connectivity; target URLs, routing and connection metadata relevant to the request. | Distributed processing locations relevant to the selected proxy route. Only authorized source access is permitted. |
| Tight Studio — OpenBrand Extract API | Customer-requested brand extraction; submitted website URL, extracted brand information and related request metadata. | Applicable service and supplier locations. Used when brand extraction is invoked, rather than for every chat. |
| Functional Software, Inc., doing business as Sentry | Application error and reliability monitoring; scrubbed errors, release/environment information and necessary identifiers or context. | EU-region configuration for the selected service, with applicable supplier support/onward-processing arrangements. Role follows whether the particular record is customer-controlled content or Chat4U's own operational data. |
Customer content is not used by Chat4U or its AI suppliers to train general-purpose or shared models. This does not mean every supplier retains no information. OpenAI Batch files are cleaned up after processing with the input-file safeguard described in the Retention Schedule; provider security records, other feature state and traces follow their applicable bounded retention. No universal zero-retention assurance is made.
3. Account, website and operating providers
| Provider | Purpose and information | Role |
|---|---|---|
| Clerk, Inc. | Authentication, account identity, organization membership and session information. | Service provider for Chat4U account administration; any separately instructed customer-data processing remains subject to its actual role. |
| PostHog, Inc. | Permitted website/dashboard product measurement; pseudonymous account/device references, allowed event/page context, attribution and device information. | Processes the defined measurement for Chat4U; EU-region service configuration does not make every support/onward transfer EU-only. Consent and account controls follow Cookies. |
| Plus Five Five, Inc. — Resend | Delivery of marketing-site contact enquiries and relevant email metadata. | Service provider for the stated communication purpose; United States processing under the applicable arrangement. This is not a general permission to email customer visitors. |
| SPD Hosting — email gateway | Inbound email routing for Chat4U contact addresses, including sender/recipient details, messages and attachments submitted to those addresses. | Israel-based email-service provider. The relevant email-service and onward-processing arrangements govern processing locations; the provider's location does not establish where every mailbox copy is stored. Its role follows the purpose and content of the communication. |
| Amazon Web Services EMEA SARL — AWS Amplify and related website services | Marketing-site hosting, website requests and relevant operational metadata. | Service provider for our website operations, distinct from each customer-content processing function above. |
| Cloudflare, Inc. — DNS | DNS records and domain-management information. | DNS/domain operations. This description does not represent that all application traffic is proxied through Cloudflare. |
| Applicable Paddle entity identified in checkout/receipt | Merchant-of-Record checkout, payment, tax, invoice, refund and subscription records. | Independent controller for its reseller/payment purposes and other roles identified in its applicable terms. A provider invoice identifies the relevant contracting entity. |
Authentication can also involve Clerk's further providers, including Cloudflare's browser security and abuse-prevention functions on the authentication domain. That role is distinct from our direct use of Cloudflare for DNS. Relevant further-provider information forms part of the supplier information described in section 5.
We minimize analytics and error payloads and exclude conversation content, authentication secrets and unrelated input data from ordinary product measurement. Internal identifiers and sanitized paths can remain personal data. We do not claim that every monitoring record is anonymous or that the optional WooCommerce measurement feature is absent merely because PostHog is not installed in the widget.
4. Customer-selected systems and platform boundaries
Shopify: processes the merchant platform, app installation/approval, billing and relevant shop records under its own arrangements. Chat4U's access and service-side copies remain subject to authorization and the applicable DPA and Shopify duties. Shopify is not a general substitute for Paddle on unrelated projects.
WordPress and WooCommerce: software running on the merchant's host does not become a single Chat4U hosting supplier. The merchant controls its hosting, native orders, mail delivery and selected extensions. Guest verification fields go to that installation and its configured mail service; Chat4U's configured AI supplier may process minimized authorized order results for the current answer.
Social channels: Meta and other supported channel operators handle their own accounts, communications and channel data under their applicable arrangements. Enabled channels can send scoped messages and media to Chat4U and receive replies. They are not all Chat4U subprocessors merely because a customer connects an account; the actual product and contracting entity matter.
CRM and other destinations: HubSpot, Inc., Salesforce, Inc., and other customer-selected tools receive the fields and scope the customer authorizes. Their processing regions, retention and independent obligations follow the customer's relevant account and arrangement. External AI clients or tools likewise receive only their authorized scope. Chat4U remains responsible for its own delivery and processing, without taking over every destination's independent data lifecycle.
5. International transfers and information
The DPA governs restricted transfers and required safeguards. A provider's country of incorporation is not a complete list of processing locations, and a supplier website does not itself establish the customer's specific transfer contract. We maintain the relevant supplier identities, purposes, processing locations, safeguards and information about further processors necessary for the Customer to assess the relevant processing chain. We make that information available before the relevant authorization through this list and, where necessary to protect confidential information, a supplementary supplier schedule delivered to the account owner through the existing account or agreed contact route. The Customer need not make a separate request to receive that necessary information. Relevant changes follow the DPA's notice and authorization requirements; confidential delivery does not remove them. Further information and appropriate copies of transfer safeguards may be requested through privacy@chat4u.ai, subject to proportionate confidentiality protection.
We do not promise that all processing stays in one country. Relevant adequacy decisions, completed contractual mechanisms and supplementary measures are applied to the actual flow, including onward transfers.
6. Changes and objections
The DPA provides general authorization for disclosed relevant subprocessors and at least 14 calendar days' direct advance notice for ordinary additions or replacements before affected data is processed. We notify account owners broadly unless reliable records support a narrower affected group. Notice explains the supplier, purpose, relevant data, location information, start and objection route.
Send a reasoned data-protection objection to support@chat4u.ai during that period. We assess reasonable solutions, protect the affected data while an objection is unresolved, and provide the DPA's affected-service exit and unused-value refund where no workable solution is available. An emergency does not create a blanket exception to notice or an outstanding objection. A change to a customer-selected independent provider follows its own applicable relationship as well; describing its actual role does not erase a Chat4U subprocessor obligation.
English is the controlling language of this document. Version: 2026-11-consolidated-v1. Permanent link to this version. SHA-256: 36062a297d690e6c4fe5ffd1b18d31adc2863ec8a2bcd3298cc58829fdc63397.