Subprocessors
1.About this page
A subprocessor is a third party we engage to process personal data on behalf of our customers. This page lists them, what each one does, and where each processes data. It forms Annex III of our Data Processing Addendum and is incorporated into it.
Every subprocessor is subject to due diligence before engagement and to a written agreement imposing data protection obligations no less protective than those we owe our customers. We remain fully liable to you for their performance.
Why there are two tables. Only the vendors in Section 2 can access the contents of your workspace. Section 3 lists vendors that handle information where we are the controller — sales enquiries, billing contacts, support correspondence — and which never receive your workspace content. We keep these separate so you can see exactly which companies could reach your team's data, rather than having to infer that from a single undifferentiated list.
2.Subprocessors that process Customer Data
These vendors process personal data on behalf of our customers.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Supabase Pte. Ltd. Singapore |
Database, file storage, authentication, and realtime updates | Customer Data | United States (West US, Oregon) |
| Vercel Inc. United States |
Application hosting and content delivery | Customer Data in transit; server and error logs | United States |
| Resend (Plus Five Five, Inc.) United States |
Transactional and notification email | Recipient contact details and notification content | United States |
| PostHog, Inc. United States |
Product analytics, error reporting, and session recording | Usage data, error diagnostics, and session recordings. Session recordings do not include login page, names, emails, readable text of chat messages, tasks, projects, SOPs, leave notes, or timesheet notes. Photos and images in the recording are not captured. | United States (Virginia) |
| Cloudflare, Inc. United States |
Bot protection on sign-in | IP address and device information | Global (nearest Cloudflare location) |
| Upstash, Inc. United States |
Rate limiting | IP addresses and account identifiers | United States (AWS us-east-2, Ohio) |
3.Vendors processing data where Aiome is the controller
These vendors support our own business — marketing, sales, and support. None of them receives the contents of a customer workspace, except to the extent a person voluntarily includes such content in a message they send us.
| Vendor | Purpose | Data processed | Location |
|---|---|---|---|
| Vercel Inc. United States |
Website hosting | Server logs | United States |
| PostHog, Inc. United States |
Website analytics and session recording | Website usage data and, if accepted, session recordings. Session recordings do not include login page, names, emails, readable text of chat messages, tasks, projects, SOPs, leave notes, or timesheet notes. | United States (Virginia) |
| HighLevel Inc. (GoHighLevel) United States |
CRM, contact form, and marketing communications | Contact and inquiry information | United States |
| Featurebase (CORDNET OÜ) Estonia |
Help center, feature requests, and support messaging | Support identity and the content of messages sent to us | 🇪🇺 Netherlands, Germany, Ireland |
| Zoho Corporation (Zoho Workplace) United States |
Business email | Email correspondence | United States |
One service that receives no personal data. To show public holidays in the time off calendar, Aiome asks a public holiday reference service (Nager.Date) which dates are holidays in a given country and year. It receives a country and a year, and nothing about you or your team. It is named here for completeness rather than as a subprocessor.
4.Payments
| Provider | Role | Data processed | Location |
|---|---|---|---|
| Paddle.com Inc. (United States) for buyers in the United States, and Paddle.com Market Ltd (United Kingdom) for buyers elsewhere | Merchant and seller of record — an independent controller, not our subprocessor | Payment and billing information. Aiome does not receive full card numbers | Global |
Because Paddle acts as the seller of record for your purchase, your purchase contract is with Paddle rather than with Aiome. Paddle determines the purposes and means of processing your payment data and does so under its own privacy notice, and it is responsible for calculating and remitting sales tax and VAT. It is listed here for transparency rather than as a subprocessor, and the subprocessor change procedure in Section 6 does not apply to it. See our Refunds page for how this affects cancellations and refunds.
5.AI and machine learning providers
None currently engaged. As of the date of this page, Aiome does not send Customer Data to any AI or large language model provider, and no AI provider processes the contents of your workspace.
If we introduce a feature that uses a third-party AI model to process Customer Data, that provider will be added to the table in Section 2 and you will receive at least 30 days' notice before the processing begins, with the right to object under Section 6.
When that happens, we commit to engaging only providers whose terms prohibit training on our customers' data, and to giving workspace administrators a control governing whether these features operate on their workspace. See Section 6 of our Privacy Policy.
6.How we notify you of changes
Before engaging a new subprocessor to process Customer Data, we will give at least 30 days' notice by:
- updating this page; and
- emailing the administrators of every affected workspace.
If you would like the notice sent to additional people — a security or procurement contact, for example — tell us at aiome.io/contact and we will add them.
Your right to object. You may object to a new subprocessor on reasonable data protection grounds within 30 days of notice. We will discuss it in good faith, and if it cannot be resolved you may terminate the affected part of the Service without penalty and receive a pro-rata refund of prepaid fees for the unused period. See Section 8 of the DPA.
Where we must replace a subprocessor urgently to maintain the security or continuity of the Service, we will give notice as soon as reasonably practicable.
Related documents: Data Processing Addendum · Privacy Policy · Security · Terms of Service