Subprocessors
Last updated: April 29, 2026
Emporiqa, operated by Rosel Group LTD., engages the following third parties ("Subprocessors") to process personal data on your behalf. This page is authoritative and is referenced from our Privacy Policy and Data Processing Addendum.
Each Subprocessor is contractually bound to process data only on our documented instructions and to maintain appropriate security. For our LLM subprocessors specifically, each provider's published API data-usage policy prohibits use of API data to train or improve their models by default, and we do not opt in to any model-improvement program that would change that.
Current Subprocessors
| Subprocessor | Purpose | Data categories | Location |
|---|---|---|---|
| OpenAI, L.L.C. | Large language model provider for chat response generation, agent reasoning, and text embeddings | Customer chat messages, and product/page content sent for processing | United States |
| OpenRouter, Inc. | Large language model provider for catalog content processing and search result reranking | Product and page content sent for processing, and search queries | United States |
| Stripe, Inc. | Subscription billing and payment processing | Account contact information, payment method metadata (we do not store full card numbers) | United States, Ireland |
| Cloudflare, Inc. | CDN, TLS termination, DDoS protection, and edge caching for platform and widget traffic | IP addresses, HTTP request and response metadata, proxied request bodies in transit | United States (global edge network) |
| Functional Software, Inc. d/b/a Sentry | Application error tracking and performance monitoring to diagnose platform issues | Stack traces, request metadata, platform user identifiers; chat message bodies are scrubbed before submission | United States |
| Hetzner Online GmbH | Application infrastructure, PostgreSQL databases, Redis cache, self-hosted vector database, object storage | All data at rest (encrypted) | Germany (EU) |
Data-handling terms
- No training: Our LLM subprocessors' published API data-usage policies state that data submitted via the API is not used to train or improve their models by default. We do not opt in to any model-improvement programs that would change this, and we do not feed customer data into our own training pipelines.
- Zero-retention where available: For LLM processing, we use Subprocessor endpoints with zero-retention behaviour where the Subprocessor offers an approved ZDR tier. Request and response bodies are not persisted on the Subprocessor's side beyond the length of the request.
- Encryption in transit: All data transfers between Emporiqa and Subprocessors use TLS 1.2 or higher.
- Transfer safeguards: For Subprocessors outside the European Economic Area, we rely on Standard Contractual Clauses approved by the European Commission (Decision 2021/914), additional technical and organisational measures, and Data Privacy Framework certification where applicable.
Not Subprocessors
The following tools do not process customer data on our behalf and therefore are not Subprocessors:
- Qdrant vector database: we run Qdrant open-source software on our own infrastructure. Qdrant Solutions GmbH does not receive or host any customer data.
- Official platform extensions (Drupal Commerce, WooCommerce, Sylius, PrestaShop, Shopware, Magento 2 / Adobe Commerce): these run inside your own store and transmit data to our webhook endpoints. They are first-party code we publish, not third-party recipients.
Changes to this list
We will notify registered account holders at least 30 days before we engage a new Subprocessor that processes customer personal data, or replace an existing one. If you object to a change, you may contact us at [email protected].
Infrastructure-only changes (e.g., hosting region adjustments, internal tooling vendors that do not process customer personal data) will be reflected on this page but may not trigger an advance notice.
Contact
For questions about this list or to request a Data Processing Addendum, contact us at [email protected].
Governing Language
This page is published in English. Translations into other languages are provided for convenience only. In case of any discrepancy or inconsistency between the English version and any translation, the English version shall prevail.