Subprocessors
Last updated: October 19, 2026
Emporiqa, operated by Rosel Group LTD., engages the following third parties ("Subprocessors") to process personal data on your behalf. This page is authoritative and is referenced from our Privacy Policy and Data Processing Addendum.
Each Subprocessor is contractually bound to process data only on our documented instructions and to maintain appropriate security. For our LLM subprocessors specifically, each provider's published API data-usage policy prohibits use of API data to train or improve their models by default, and we do not opt in to any model-improvement program that would change that.
Current Subprocessors
| Subprocessor | Purpose | Data categories | Location |
|---|---|---|---|
| OpenAI Ireland Ltd | Large language model provider for chat response generation, agent reasoning, and text embeddings; where a store has voice mode on, speech-to-text for customers' spoken messages and text-to-speech for spoken replies | Customer chat messages, photos customers send in the chat where the store allows them (described for the reply), voice recordings of spoken messages where voice mode is on (transcribed, not stored by us), product/page content sent for processing, and where a store uses order tracking or store rules, the details a customer gives for them and the store's answer (for example order contents and delivery details) | Ireland; processed in the United States by OpenAI's affiliates |
| OpenRouter, Inc. | Search result reranking with the Cohere Rerank model; OpenRouter passes the request to Cohere, the model's provider | The shopper's search query, with product and page text | United States |
| Stripe, Inc. | Subscription billing and payment processing | Account contact information, payment method metadata (we do not store full card numbers) | United States, Ireland |
| Cloudflare, Inc. | CDN, TLS termination, DDoS protection, edge caching for platform and widget traffic, and bot assessment when a visitor is asked to confirm they are human in the chat | IP addresses, HTTP request and response metadata, proxied request bodies in transit; pictures uploaded for the chat, which are cached at the edge as content at rest; where a chat bot check is shown, the browser signals Cloudflare Turnstile collects to assess it | United States (global edge network) |
| Functional Software, Inc. d/b/a Sentry | Application error tracking and performance monitoring to diagnose platform issues | Stack traces, request metadata, platform user identifiers; chat message bodies are scrubbed before submission | Germany (EU region); company and account data in the United States |
| Sendinblue SAS (Brevo) | Delivery of the emails we send from our no-reply address: sign-in links, account notices, handoff alerts to a store's team, and emails from a store's rules to its team | Recipient email addresses and email content; handoff alerts can include the contact details and messages a customer gave in the chat; rule emails can include the details a store rule collected (including any taken from a signed-in customer's account in the shop), the customer's message and, as the reply address, the customer's email address | France (EU) |
| Hetzner Online GmbH | Application infrastructure, PostgreSQL databases, Redis cache, self-hosted vector database, file storage | All stored data (the servers we run in Germany) | Germany (EU) |
Data-handling terms
- No training: Our LLM subprocessors' published API data-usage policies state that data submitted via the API is not used to train or improve their models by default. We do not opt in to any model-improvement programs that would change this, and we do not feed customer data into our own training pipelines.
- Retention: Our LLM subprocessors do not use API data for training. We do not keep a log of model calls. We cache a few model answers for a short time so a retry does not call the model again: the English translation of a customer's message for a store's team email for 7 days, and the answers that decide which store rule applies and which details a message contains for 10 minutes. OpenAI keeps requests for up to 30 days to check for abuse. We have asked OpenAI for zero data retention; until OpenAI grants it, the 30 days apply.
- Encryption in transit: All data transfers between Emporiqa and Subprocessors use TLS 1.2 or higher.
- Transfer safeguards: For Subprocessors outside the European Economic Area, we rely on Standard Contractual Clauses approved by the European Commission (Decision 2021/914), additional technical and organisational measures, and Data Privacy Framework certification where applicable.
Not Subprocessors
The following tools do not process customer data on our behalf and therefore are not Subprocessors:
- Qdrant vector database: we run Qdrant open-source software on our own infrastructure. Qdrant Solutions GmbH does not receive or host any customer data.
- Official platform extensions (Drupal Commerce, WooCommerce, Sylius, PrestaShop, Shopware, Magento 2 / Adobe Commerce): these run inside your own store and transmit data to our webhook endpoints. They are first-party code we publish, not third-party recipients.
- Zapier, Make and a merchant's own systems: where a merchant sets up store rules, the details a rule collects can be sent to an endpoint on the merchant's own shop, to the store's team by email, or to a Zapier or Make webhook in the merchant's own account. The merchant chooses these recipients and we send to them on the merchant's instructions. They do not process data on our behalf, so they are not our Subprocessors; the merchant's own agreements with them apply.
Changes to this list
We will notify registered account holders at least 30 days before we engage a new Subprocessor that processes customer personal data, or replace an existing one. If you object to a change, you may contact us at [email protected].
Vendors that do not process customer personal data, such as internal tooling, are added to this page without advance notice.
Contact
For questions about this list, contact us at [email protected].
Our Data Processing Addendum is published and applies automatically to every customer.
Governing Language
This page is published in English. Translations into other languages are provided for convenience only. In case of any discrepancy or inconsistency between the English version and any translation, the English version shall prevail.