Subprocessor List

Overview

This Subprocessor List identifies the external service providers engaged by StackBooster Corporation (a Delaware corporation, United States of America, 8 The Green #12146, Dover, DE 19901, United States of America; "StackBooster") as a Processor or Subprocessor, depending on the Client's role, in connection with the provision of the Services under the Master SaaS Agreement, the Order Form and the Data Processing Agreement (DPA).

Not all Subprocessors listed below are used in every Client deployment. The Subprocessors actually used depend on the products, AI Agents, features, channels and configuration selected by the Client under the applicable Order Form and Functional Scope Annex.

StackBooster processes the Client's Personal Data in accordance with the DPA. The production infrastructure of the Platform is hosted on Amazon Web Services. Information on the hosting region applicable to a Client's deployment is available upon request. Transfers of the Client's Personal Data to StackBooster in the United States, and access by StackBooster personnel located outside the European Economic Area, are governed by the EU Standard Contractual Clauses - Module Two where the Client acts as Controller or Module Three where the Client acts as Processor - and, for data subject to the UK GDPR, the UK International Data Transfer Addendum to the EU Commission Standard Contractual Clauses.

In accordance with the DPA, this Subprocessor List and the safeguards described in it apply to all Clients regardless of jurisdiction.

Subprocessors

Core infrastructure

AI model providers

AI model providers process prompts, context and outputs solely to generate responses for the Client's AI Agents, under commercial API terms that prohibit training on customer data. The provider used for a given task is determined by StackBooster's configuration.

Feature-specific providers

Client-Controlled Platform Integrations

StackBooster may, upon the Client's documented instructions, integrate the Platform with third-party services directly controlled by the Client, including the Client's own cloud accounts (such as AWS, Google Cloud and Microsoft Azure) and Kubernetes clusters, code repositories (such as GitHub), domain registrars and DNS providers, Google Workspace, Microsoft 365, Slack, Notion, Telegram, CRM systems, email accounts, social media accounts and pages (such as Meta, Instagram, LinkedIn, X, TikTok, YouTube, Reddit, Threads and Pinterest) and advertising accounts. The providers of such services shall not be considered Subprocessors of StackBooster where the Client owns and controls the relevant account and grants StackBooster access through the provider's official API, OAuth or another provider-supported authorization mechanism. In such cases, the relevant platform provider acts either as the Client's processor pursuant to an agreement entered into directly between the Client and that provider in accordance with Article 28 of the EU GDPR or as an independent controller, as applicable. StackBooster accesses the relevant service solely within the scope of the permissions granted by the Client.

Updates to the List and Right to Object

StackBooster notifies Clients of the intended addition or replacement of a Subprocessor with the advance notice specified in the DPA, enabling the Client to raise a reasoned objection in accordance with Article 28(2) EU GDPR and the provisions of the DPA. StackBooster remains liable to the Client for the acts and omissions of its Subprocessors to the extent specified in the DPA.

Data Transfers and Additional Documentation

A data processing agreement or equivalent data processing terms forming part of the applicable service agreement are in place with each Subprocessor. Where Personal Data is transferred outside the EEA, appropriate transfer mechanisms are used, including the EU Standard Contractual Clauses, the EU-U.S. Data Privacy Framework where the Subprocessor is certified, and, for data subject to the UK GDPR, the UK International Data Transfer Addendum to the EU Commission Standard Contractual Clauses.

StackBooster maintains documentation concerning the applicable transfer mechanisms and safeguards, including transfer impact assessments where required. Relevant documentation may be made available to Clients upon a reasoned request and subject to confidentiality.

For questions concerning this Subprocessor List, please contact privacy@stackbooster.io with a copy to legal@stackbooster.io.