Legal

Subprocessors

Last updated

The third-party companies ApiWay, Inc. uses to run Apiway, what each one does, which data it handles, where, and under which transfer safeguards. This page is Annex III of our Data Processing Addendum and the list referred to in our Privacy Policy.

How to read this list

A sub-processor is a company we engage that handles personal data on our behalf while we provide the Service. Each one is bound by a written contract with data protection obligations, and we remain responsible for its work as set out in the Data Processing Addendum (§7).

The companies under Services you connect yourself are not our sub-processors: data goes to them because you connected your own account there and told Apiway to use it.

Infrastructure

Fornex

Server hosting (the main server and a separate virtual server)

Purpose
Runs the Service: the application, the main PostgreSQL database, the background workers (including AI generation jobs), the apps and pages our customers publish (Hosted Apps, Apiway Pages), and the Telegram bridge for connected personal Telegram accounts. A separate Fornex VPS runs our ClickHouse analytics database for internal usage and error statistics.
Personal data
All Service data: account and workspace data, contacts and lists, email campaigns and their events, lead records, mail-room and Telegram-room content, booking data, files, generation jobs, billing records (main server). Usage events, error logs and server metrics linked to an account identifier (analytics VPS).
Location
Netherlands (EU)
Transfer safeguards
Processing takes place in the EEA. Remote administration by ApiWay from the United States is covered by the EU Standard Contractual Clauses in the Data Processing Addendum (§12).

Amazon Web Services, Inc. and its affiliates

Amazon S3, Amazon CloudFront, Amazon SES, Amazon SNS

Purpose
Stores files and generated images and videos (S3) and delivers them through a CDN (CloudFront); sends email for Email Marketing, sequences, forms and Apiway Workspace AI Bot invitations and receives delivery, bounce and complaint notices (SES, SNS); receives inbound email for the Apiway Workspace AI Bot (SES inbound, S3, SNS); keeps encrypted database backups, deleted after 14 days (S3).
Personal data
Uploaded and generated files, mail attachments kept for Rooms, screen and voice recordings; recipient email addresses, message content, headers and delivery events; raw inbound bot email; full database backups.
Location
EU — Stockholm (eu-north-1) for storage, backups and outbound email; Ireland (eu-west-1) for inbound bot email. CloudFront serves cached files from edge locations worldwide.
Transfer safeguards
EU regions; CloudFront edge delivery and any access from outside the EEA under the AWS Data Processing Addendum, which incorporates the SCCs; DPF where certified.

Cloudflare, Inc.

CDN, reverse proxy, DNS, TLS, custom hostnames

Purpose
Sits in front of every Apiway website and app: routes and protects traffic, terminates TLS, filters attacks, manages DNS records for email-sending subdomains and issues certificates for the custom domains customers attach to their published apps.
Personal data
All requests and responses passing through the network, including IP addresses, request headers, cookies and the content of pages, forms and uploads in transit.
Location
Global edge network; Cloudflare, Inc. is based in the United States.
Transfer safeguards
SCCs under Cloudflare's Data Processing Addendum; DPF where certified.

AI models

When you use a feature that runs an AI model, the input that feature needs is sent to the model provider for that request and the result comes back to us. We use paid API tiers; where a provider offers terms under which it does not train its general models on API data, we use them.

Google LLC

Gemini API, Vertex AI (Veo video), Cloud Vision, Cloud Storage (temporary video output)

Purpose
Image and video generation and editing; the Apiway assistant (chat, mail assistant, drafts and summaries, task extraction from mail and Telegram rooms); voice transcription; reading images, PDFs and websites for brand setup; product matching by image (Cloud Vision).
Personal data
Prompts, uploaded photos and videos, product images, generated output; text of the emails, chat messages and files a feature is asked to read, summarise or answer; voice messages; company and brand information.
Location
United States and other Google data-center regions (Gemini API); United States, us-central1 (Vertex AI video generation).
Transfer safeguards
SCCs under the Google Cloud Data Processing Addendum; DPF where certified.

Anthropic, PBC

Claude API

Purpose
Writing and rewriting email copy and subject-line variants, brand and business extraction, summaries and digests, room and assistant turns where Claude is the selected model, Scenario Lab, and the briefs and code generation behind App Factory and Hosted Apps builds.
Personal data
The text and files a feature sends to the model: drafts, brand and website content, email and chat excerpts the feature is asked to work with, app briefs and source code.
Location
United States
Transfer safeguards
SCCs under Anthropic's Data Processing Addendum; DPF where certified.

PiAPI (API aggregator), for models by Kuaishou (Kling) and ByteDance (Seedream, Seedance)

Image and video generation API

Purpose
Generates images (Seedream) and videos (Kling, Seedance) when you pick one of these models, and re-renders an image request on Seedream automatically when Google's model declines it on content grounds.
Personal data
Prompts, the reference photos or videos you supply for that generation, and the generated output.
Location
To be confirmed with the provider; processing may take place outside the EEA, including in China, Singapore and the United States.
Transfer safeguards
Being confirmed. We are putting contractual transfer safeguards in place with this provider; until then, if this matters to you, choose a Google model for your generations.

Email, SMS and messaging

Resend, Inc. (and an SMTP relay as fallback)

Transactional email

Purpose
Sends sign-in codes, password resets, invitations and service notifications.
Personal data
Recipient email address, name, message content.
Location
United States
Transfer safeguards
SCCs under Resend's Data Processing Addendum; DPF where certified.

Twilio Inc.

Programmable SMS

Purpose
Sends phone sign-in codes, and SMS that a customer's Hosted App sends to that customer's own users.
Personal data
Phone number and message content (including one-time codes).
Location
United States
Transfer safeguards
SCCs under Twilio's Data Protection Addendum; DPF where certified.

Telegram (Telegram FZ-LLC and affiliates)

Telegram Bot API and the Telegram network

Purpose
Carries the messages of Telegram team rooms, the personal assistant in Telegram, mail notifications to Telegram, messages you send from Apiway through a personal Telegram account you connected, and our internal operations alerts.
Personal data
Message text, files and voice messages exchanged with our bot or sent on your instruction; Telegram user IDs, names and usernames of chat participants.
Location
Telegram's own infrastructure, in several jurisdictions outside the EEA.
Transfer safeguards
Telegram does not offer a data processing agreement. Data reaches Telegram only when you use Apiway inside Telegram or ask us to send something there.

Social and advertising platforms

These platforms are independent controllers of the data on their own services. We exchange data with them through their official APIs to run the features you switch on, and — for Meta and Google only — to measure Apiway's own advertising after you consent.

Meta Platforms Ireland Ltd. / Meta Platforms, Inc.

Instagram and Facebook Graph API, Lead Ads, Meta Pixel, Conversions API

Purpose
Runs Instagram automations (Comment → DM, the DM assistant), reads your own Instagram media for those automations, receives Facebook and Instagram lead-form leads for Lead Transfer, and — only with marketing consent on our website — measures Apiway's own ads (Pixel in the browser, Conversions API from our server).
Personal data
Instagram-scoped user IDs, usernames, comments and direct messages exchanged with your account; lead-form answers; for Pixel and Conversions API, page events, hashed contact details and browser identifiers of consenting visitors.
Location
United States and Ireland
Transfer safeguards
Meta's platform and business tools terms, including SCCs where Meta offers them.

TikTok Technology Ltd. / TikTok Inc. and affiliates

TikTok for Business API, Lead Generation, Content Posting API

Purpose
Receives TikTok lead-form leads for Lead Transfer, reads ad-account reports for connectors, and posts videos to the TikTok account you connect when you switch on cross-posting.
Personal data
Lead-form answers; ad-account metrics; the videos and captions you choose to post.
Location
Ireland, United States, Singapore and other TikTok regions
Transfer safeguards
TikTok's platform terms, including SCCs where TikTok offers them.

Google LLC

Google Analytics 4

Purpose
Measures how visitors use Apiway's own websites — only after a visitor grants analytics consent in the cookie banner. Never loaded on pages and forms we host for our customers.
Personal data
Pseudonymous identifiers, page events, device and browser information, approximate location.
Location
United States and other Google regions
Transfer safeguards
SCCs under Google's Ads Data Processing Terms; DPF where certified.

Payments and commerce

Stripe, Inc. / Stripe Payments Europe, Ltd.

Stripe Billing and Checkout

Purpose
Takes payment for subscriptions, credit top-ups and Lead Transfer, and handles invoices, refunds and disputes. Card numbers go straight to Stripe and never reach our servers.
Personal data
Name, email, billing address, payment method details, tax IDs, transaction history.
Location
United States and Ireland
Transfer safeguards
SCCs under Stripe's Data Processing Agreement; DPF where certified.

Shopify Inc.

Shopify Admin API, Shopify Managed Pricing

Purpose
For stores that install the Apiway Shopify app: bills the subscription through Shopify, keeps the store's product catalog in sync with Apiway, and creates draft products in the store when you approve them.
Personal data
Store and shop-owner details, plan and billing status, product titles, descriptions, images and variants.
Location
Canada and United States
Transfer safeguards
Canada adequacy decision; SCCs under Shopify's Data Processing Addendum for the United States.

Feature providers used only where enabled

Each of these is switched on per feature by our configuration. If a feature is not enabled, nothing is sent to its provider.

One of: Bouncer, Clearout, ZeroBounce, MillionVerifier or Emailable

Email address verification

Purpose
Checks whether addresses on a list can receive mail, when you run Email Verification.
Personal data
The email addresses you submit for checking.
Location
Depends on the provider in use (EEA or United States, possibly India). We name the active provider on request.
Transfer safeguards
SCCs under the provider's data processing terms where it processes outside the EEA.

Google LLC (Places API), YANDEX LLC (Maps organisation search), DoubleGIS LLC (2GIS)

Business directory lookup

Purpose
During brand setup, looks up the business you name in a maps directory so you can confirm its address, phone and website ("Is this you?").
Personal data
The business name, phone number or address you entered.
Location
United States (Google); Russia (Yandex, 2GIS)
Transfer safeguards
Google: SCCs; DPF where certified. Yandex and 2GIS: see note above — used only for business details.

Pinterest, Inc.

Pinterest API (Apiway's own business account)

Purpose
Mirrors public listings of the Legacy Creator Marketplace as pins on Apiway's own Pinterest account, with a link back to the creator's storefront. Off unless switched on.
Personal data
Public listing images, titles and captions. No private content.
Location
United States
Transfer safeguards
Pinterest is an independent controller of the published pins.

Automattic Inc.

Gravatar

Purpose
Shows the profile picture registered for an email address (your account, mail senders), if one exists.
Personal data
A SHA-256 hash of the email address; the viewer's IP address when the browser loads the picture.
Location
United States
Transfer safeguards
SCCs; DPF where certified.

ActiveCampaign, LLC

Marketing CRM

Purpose
Adds the email address of a person who signs in to Apiway to Apiway's own customer mailing list, where configured.
Personal data
Account email address.
Location
United States
Transfer safeguards
SCCs under ActiveCampaign's Data Processing Agreement; DPF where certified.

Services you connect yourself

These receive data because you connected your own account or chose them as a destination. They act under your agreement with them, and you can disconnect them at any time.

  • Google Workspace — Gmail, Google Calendar, Google Drive, Google Sheets. Your mailbox, calendars and files, read and written through Google's APIs when you connect them; Sheets also as a Lead Transfer destination.
  • Google Analytics 4 and Search Console (your properties). Reports read through our service account after you grant it view access.
  • Instagram, Facebook, TikTok, YouTube and Pinterest accounts you connect. Posting, automations, lead forms and reports on your own accounts.
  • Stripe (your account), Shopify (your store), HubSpot, Pipedrive, Trello, Notion. Reporting connectors and destinations, using read-only keys or the access you grant.
  • Mailchimp, ActiveCampaign, ConvertKit (Kit), MailerLite, ClickSend, Trello, HubSpot, Google Sheets, your own Telegram bot. Lead Transfer destinations you choose for your leads.
  • Slack and Discord. Notifications to your Slack webhook; mail shared to your Discord.
  • A personal Telegram account. Messages you send from Apiway through your own Telegram account.
  • Figma. A file you point us to with your own access token, read once to set up your brand; the token is not stored.
  • WayForPay and other payment providers inside apps you build. Payment links created with your own merchant keys.
  • ChatGPT, Claude, Codex and other AI assistants. When you connect an AI assistant to your workspace over MCP, it reads and writes what you ask it to, under its provider's own terms.
  • Public links you paste. Files and folders at a public Google Drive, Yandex Disk or similar link that you ask us to read.

Services that receive no personal data

  • jsDelivr (Prospect One sp. z o.o.). Public CDN that delivers the in-browser models for the free background-removal tool and the exercise tracker. Your images and camera frames never leave your browser.
  • DataForSEO and Yandex Wordstat (where enabled). Receive search phrases for a site plan to return their monthly search volumes.
  • Openverse (WordPress.org). Receives search terms to find openly licensed images.
  • IndexNow. Receives the URLs of our public pages so search engines can recrawl them.
  • Search engines and AI crawlers. Index public pages (storefronts, published pages, blog, docs) under their own terms. We do not control them and cannot recall their copies or caches.

Changes and how to be notified

We give at least thirty (30) days’ notice before a new sub-processor starts processing personal data on a customer’s behalf, by updating this page and by email to the account owner or a notice in the Service, as set out in §7.3 of the Data Processing Addendum. In an emergency, such as replacing a provider that fails, we may switch sooner and will tell you as soon as practicable.

To get these notices by email even if you are not an account owner, write to info@apiway.ai with the subject “Subscribe to subprocessor updates”. To object to a new sub-processor, write to the same address within the notice period; §7.4 of the Data Processing Addendum explains what happens next.

What changed on

  • Removed Supabase and Hetzner: Apiway no longer uses either. The database moved to our own servers at Fornex in the Netherlands.
  • Named providers already in use but missing from the previous list: Fornex, Cloudflare, Amazon SES, SNS and CloudFront, Anthropic, PiAPI with Kuaishou and ByteDance models, Google Vertex AI and Cloud Vision, Telegram, Meta, TikTok, Google Analytics 4, the email verification provider, the business directory lookups, Gravatar and ActiveCampaign.
  • Separated the services you connect yourself from our sub-processors.

Contact

ApiWay, Inc., a corporation organised in Delaware, USA, Suite S2, 1050 North Third Street, Laramie, Wyoming 82072, USA. Questions about this list: info@apiway.ai.