Legal
Subprocessors
Last updated: October 11, 2026
These are the companies that process personal data for AIXEL Solutions S.r.l., grouped by where they are used, with what each one does, where the data is processed and what it can see. How we handle personal data is explained in the Privacy Policy; for AIXEL CRM the AIXEL CRM Data Processing Agreement also applies.
Website, AI & Digital Readiness and client work
| Who | What for | Where | What they see |
|---|---|---|---|
| Vercel Inc. (USA) | hosting of the website and of its server functions | EU (Frankfurt); Standard Contractual Clauses | form submissions in transit, technical logs, cookieless statistics |
| Supabase Pte. Ltd (Singapore) | database and file storage for the AI & Digital Readiness assessment and the AIXEL CRM withdrawal register | EU (Frankfurt); Standard Contractual Clauses | requests, reports, questionnaire answers and uploaded files; for withdrawals: name, email, contract code, message and a hash of the IP address |
| Hetzner Online GmbH (Germany) | our own servers (AIXEL Cloud): assessment processing and our internal CRM | Germany (Falkenstein) | assessment data while it is processed, business contact records |
| Anthropic (Anthropic Ireland, Limited) | AI model that drafts the assessment analysis, under Anthropic's own terms | EU and USA; Standard Contractual Clauses | public information about your company and questionnaire content; not your email address or phone number |
| Plus Five Five, Inc. - Resend (USA) | sending of transactional emails | sent from the EU (Ireland); EU-U.S. Data Privacy Framework and Standard Contractual Clauses | recipient address and email content |
| Stripe Payments Europe, Limited (Ireland) | payments for AIXEL CRM subscriptions; independent controller for fraud prevention | EU; access from the USA under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses | billing and payment data; card details are processed by Stripe only |
| Microsoft Ireland Operations Limited | our mailbox and office tools | EU; possible access from the USA under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses | emails and attachments you send us |
| Google Ireland Limited | Google Analytics, only if you allow statistics cookies | EU and USA; EU-U.S. Data Privacy Framework | pages visited, approximate location, device, analytics cookies |
| Calendly, LLC (USA) | booking of calls through our scheduling page | USA; EU-U.S. Data Privacy Framework and Standard Contractual Clauses | name, email and meeting details you enter |
AIXEL CRM (data customers enter in their instances)
| Who | What for | Where | What they see |
|---|---|---|---|
| Supabase Pte. Ltd (Singapore) | database, authentication, file storage and server functions of every instance | EU (Frankfurt); Standard Contractual Clauses | all data entered in the instance and the users' accounts |
| Hetzner Online GmbH (Germany) | servers for the instances' web application and the AI assistant connection | Germany (Falkenstein) | data in transit between browser or assistant and database; technical request logs |
| Sendinblue SAS - Brevo (France) | sending users their sign-in emails, such as invitations and password resets | EU | user's name and email address, email content |
| GitHub, Inc. (USA) | tools we use to create and update instances and to keep the backups | USA; EU-U.S. Data Privacy Framework and Standard Contractual Clauses | customer name, name and email of the instance's first administrator; every night a copy of the instance's database and files, kept encrypted with a key held only by AIXEL for 14 days; during updates a further encrypted copy of the database, kept for 7 days |
| Microsoft Ireland Operations Limited | support mailbox | EU; possible access from the USA under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses | support requests and what the customer attaches to them |
Virtual Workforce (clients who use it)
| Who | What for | Where | What they see |
|---|---|---|---|
| Anthropic | the language model that writes and reviews content | EU/US, depending on the endpoint in use | briefs, content drafts, memory used as context |
| Voyage AI | embeddings, so the employee can find what it already knows | US | memory entries, conversation summaries |
| Supabase | database, authentication and file storage | EU (eu-central-1) | all workspace data, account identities, generated images |
| Vercel | hosting for the portal | EU | request metadata |
| Hetzner Online GmbH | hosting for the service that does the actual work | Germany (Falkenstein) | request metadata, job payloads in transit |
| Zernio | publishing to social networks and reading comments, when enabled | EU | published content, public comments under it |
| Microsoft | mailbox, Teams and files, when the client connects them | the client's own Microsoft 365 tenant | email the employee sends and receives, files it is given access to |
Changes to this list
We update this page before a new provider starts processing personal data. AIXEL CRM customers receive an email at least 30 days before a new subprocessor processes their instances' data and may object, as set out in the Data Processing Agreement. Virtual Workforce clients are told in advance and may object. Connections a client does not enable, such as social publishing or Microsoft 365, never receive that client's data.