Legal

Sub-processors

In force as of September 25, 2026

To run Squidler we rely on other companies — for servers, for the AI models your agents think with, for sending email, for taking payments. Where those companies handle data on our behalf they are our sub-processors, and this page is the full list of them.

Each one is bound by a written data-processing agreement, and we remain responsible to you for what they do.

Notice before this list changes

We give at least 14 days' notice before a new sub-processor starts handling your data, so that you have time to look at it and object if you need to. If you object on reasonable data-protection grounds and we cannot resolve it, you may stop using the affected part of the Service.

To receive those notices, write to legal@squidler.io with the address you want them sent to — for many companies that is a shared legal or privacy mailbox rather than one person. Customers on a billing agreement are notified at their billing contact unless they tell us otherwise.

One exception, stated plainly: if a sub-processor has to be replaced immediately to keep the Service secure or available, we make the change and tell you straight afterwards rather than waiting out the notice period.

The list

Each entry says when it is involved. All customers means we engage it for everyone; only if used means only once you use that part of the Service.

Infrastructure

  • Hetzner (Hetzner Online GmbH) — All customers
    Servers, databases and storage — the machines the Service runs on. Offsite backups are held with Hetzner too, encrypted before they leave our servers.
    What reaches them: Everything the Service stores, at rest: accounts, conversations, files and agent memory.
    Where: Nuremberg, Germany; Offsite backups: Nuremberg, Germany · Stays in the EEA
  • Google Cloud (Google Cloud EMEA Limited) — All customers
    Key management for our content encryption; speech transcription and image generation for organisations set to EU residency; hosting for the browsing service agents use to visit web pages; load balancing and DNS for our websites.
    What reaches them: Encryption keys; voice recordings you dictate and the prompts behind generated images, where EU residency is chosen; pages your agent browses; the network traffic of every request to our site.
    Where: europe-west3 (Frankfurt, Germany); europe-west4 (Netherlands); europe-west1 (Belgium); EU multi-region · EU–U.S. Data Privacy Framework

AI providers

  • Amazon Web Services (Amazon Web Services EMEA SARL) — All customers
    The language models your agents think with, and the embeddings behind what they remember.
    What reaches them: The full content of what you and your agent exchange, including anything it retrieves from services you have connected.
    Where: EU regions (organisations set to EU residency); United States and other regions (organisations set to Global) · Standard Contractual Clauses
  • OpenAI (OpenAI Ireland Ltd) — All customers
    Speech transcription and image generation for organisations set to Global residency.
    What reaches them: Voice recordings you dictate, and the prompts and source images behind generated pictures.
    Where: United States · Standard Contractual Clauses

Messaging and email

  • Resend (Plus Five Five, Inc.) — All customers
    Sending and receiving email — both the mail your agent exchanges with you and service mail such as invitations and receipts.
    What reaches them: The subject, body and attachments of those emails, and the addresses they are sent to.
    Where: United States · Standard Contractual Clauses

Running the business

  • Stripe (Stripe Payments Europe, Limited) — All customers
    Payments, subscriptions and invoices.
    What reaches them: Your name, email, billing address and tax identifiers. Card details go directly to Stripe and never reach us.
    Where: European Union; United States · Standard Contractual Clauses
  • Auth0 (Okta, Inc.) — All customers
    Signing you in, and the login methods attached to your account.
    What reaches them: Your email address, name, profile picture, and the technical details of each sign-in.
    Where: European Union (EU region tenants) · Standard Contractual Clauses

Analytics

  • Plausible Analytics (Plausible Insights OÜ) — All customers
    Counting visits to our public pages.
    What reaches them: Which pages were viewed and where visitors arrived from. No cookies, and no profile of you across visits.
    Where: European Union · Stays in the EEA
  • PostHog (PostHog, Inc.) — All customers
    Understanding how the product is used, so we can improve it.
    What reaches them: Key events such as signing up or hiring an agent, tied to an account identifier rather than your name or email. Session replays are fully masked.
    Where: Frankfurt, Germany (EU Cloud) · EU–U.S. Data Privacy Framework

Website and advertising

  • Google Tag Manager and Google Ads (Google Ireland Limited) — All customers
    Measuring which advertising brings people to us. Loaded only after you accept marketing cookies.
    What reaches them: Your IP address, browser, and which of our pages you saw.
    Where: European Union; United States · EU–U.S. Data Privacy Framework
  • X (formerly Twitter) (X Internet Unlimited Company) — All customers
    The same advertising measurement, for campaigns on X. Loaded only after you accept marketing cookies.
    What reaches them: Your IP address, browser, and which of our pages you saw.
    Where: United States · Standard Contractual Clauses
  • Google Fonts — All customers
    Serving the typefaces our website is set in.
    What reaches them: Your IP address and browser, at the moment a page loads.
    Where: European Union; United States · EU–U.S. Data Privacy Framework

Reached by an agent at work

  • Brave Search (Brave Software, Inc.) — All customers
    Answering the web searches your agent runs. We route searches through our own server, so Brave never sees who asked.
    What reaches them: The words your agent searched for, which may include a name or a company you asked it about.
    Where: United States · Standard Contractual Clauses
  • Google Maps Platform (Google Cloud EMEA Limited) — Only if used
    Looking up places, addresses and routes when your agent needs them.
    What reaches them: The place or address being looked up.
    Where: European Union; United States · EU–U.S. Data Privacy Framework
  • OpenStreetMap (Nominatim) (OpenStreetMap Foundation) — Only if used
    The same lookups, as a fallback when Google Maps is not configured.
    What reaches them: The place or address being looked up.
    Where: United Kingdom · EU–U.S. Data Privacy Framework

Services you connect — not sub-processors

These are different, and the difference is worth stating rather than leaving to a label. A sub-processor is a company we engaged to handle your data. The services below are your own accounts at companies you already have an agreement with: your agent reaches them because you connected them, and it acts there on your instruction.

So we did not choose them, we hold no data-processing agreement with them for your data, and closing your Squidler account does not touch what is in them — deleting what sits in your Slack, your Google account or your accounting system is yours to do. We list them because your data does move there when your agent works, and you should be able to see where.

Messaging and email

  • Telegram (Telegram FZ-LLC)
    The Telegram channel, where you have connected one.
    What reaches them: Messages, photos and files exchanged in that chat, and the Telegram profile of whoever sends them.
    Where: Outside the EEA · Standard Contractual Clauses
  • Slack (Slack Technologies Limited (Salesforce))
    The Slack channel, where you have connected one.
    What reaches them: Messages and files in the conversations your agent takes part in.
    Where: United States · Standard Contractual Clauses
  • Microsoft Teams (Microsoft Ireland Operations Limited)
    The Microsoft Teams channel, where you have connected one.
    What reaches them: Messages and files in the conversations your agent takes part in.
    Where: European Union; United States · Standard Contractual Clauses
  • Your browser's push service
    Delivering notifications to a device you have subscribed. Which company this is follows from the browser you subscribed in — Google's service for Chrome, Apple's for Safari, Mozilla's for Firefox, and so on. We do not choose it and cannot name it in advance.
    What reaches them: The notification itself is encrypted to your device before it leaves us and cannot be read in transit. The push service sees that a message was delivered, to which subscription, and from what address.
    Where: Determined by the browser you subscribe in · Standard Contractual Clauses

Services you connect yourself

  • Google Workspace
    Gmail, Calendar, Drive, Docs, Sheets and Contacts — only once you connect your own Google account. Your agreement with Google covers what happens there; we are an application you authorised.
    What reaches them: Whatever your agent reads or writes there on your instruction.
    Where: European Union; United States · EU–U.S. Data Privacy Framework
  • Microsoft 365 (Microsoft Ireland Operations Limited)
    Outlook, Calendar and files — only once you connect your own Microsoft account.
    What reaches them: Whatever your agent reads or writes there on your instruction.
    Where: European Union; United States · Standard Contractual Clauses
  • Apple iCloud (Apple Distribution International Ltd)
    Calendar, contacts and mail — only once you connect your own iCloud account.
    What reaches them: Whatever your agent reads or writes there on your instruction.
    Where: European Union; United States · Standard Contractual Clauses
  • Fortnox (Fortnox AB)
    Bookkeeping and invoicing — only once you connect your own Fortnox account.
    What reaches them: The accounting records, invoices and customer details your agent works with there.
    Where: Sweden · Stays in the EEA
  • Bokio (Bokio Group AB)
    Bookkeeping and invoicing — only once you connect your own Bokio account.
    What reaches them: The accounting records, invoices and customer details your agent works with there.
    Where: Sweden · Stays in the EEA
  • Oqto (Oqto Intelligence AB)
    Document and booking workflows — only once you connect your own Oqto account.
    What reaches them: The documents and bookings your agent works with there.
    Where: Sweden · Stays in the EEA

What is not on this list

Services we run ourselves on our own servers — our search index, our logging and monitoring — are not sub-processors, because no third party is involved. Neither is a website your agent simply visits while working, any more than a browser makes every site you read a processor.

Your agent can also be asked to call a service we have never heard of, because you told it to. We cannot list those in advance; what we can tell you is that it happens at your instruction and is recorded.

Changes

  • September 25, 2026 — Amazon Web Services added
  • September 25, 2026 — Apple iCloud added
  • September 25, 2026 — Auth0 added
  • September 25, 2026 — Bokio added
  • September 25, 2026 — Brave Search added
  • September 25, 2026 — Fortnox added
  • September 25, 2026 — Google Cloud added
  • September 25, 2026 — Google Fonts added
  • September 25, 2026 — Google Maps Platform added
  • September 25, 2026 — Google Tag Manager and Google Ads added
  • September 25, 2026 — Google Workspace added
  • September 25, 2026 — Hetzner added
  • September 25, 2026 — Microsoft 365 added
  • September 25, 2026 — Microsoft Teams added
  • September 25, 2026 — OpenAI added
  • September 25, 2026 — OpenStreetMap (Nominatim) added
  • September 25, 2026 — Oqto added
  • September 25, 2026 — Plausible Analytics added
  • September 25, 2026 — PostHog added
  • September 25, 2026 — Resend added
  • September 25, 2026 — Slack added
  • September 25, 2026 — Stripe added
  • September 25, 2026 — Telegram added
  • September 25, 2026 — X (formerly Twitter) added
  • September 25, 2026 — Your browser's push service added

Entries are never deleted from this history, so you can see who handled your data at any point in the past, not only today.

Questions

Write to legal@squidler.io. If your procurement or security team needs a data-processing agreement, a transfer assessment, or answers about a specific sub-processor, ask — we would rather have that conversation than have you infer an answer from this page.

See also our Privacy Policy, which explains what we collect and why.