Version: 1.0 | Last updated: 2 November 2026 | Document ref: STQRY-DPA-01 Annex 3
STQRY uses the third parties below to help deliver the STQRY Products. Each one may process Customer Personal Data on STQRY's behalf, under the STQRY Data Processing Addendum (DPA) at https://www.stqry.com/data-processing-addendum. Each is bound by written data protection terms at least as protective as the DPA.
Get notified of changes. We update this page at least 30 days before adding a new Sub-processor, so please check it regularly. To object to a new Sub-processor, follow Section 6.4 of the DPA.
Infrastructure Sub-processors
These store or host Customer Personal Data.
| Sub-processor | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Amazon Web Services, Inc. | Cloud hosting, storage, databases, backups, content delivery, transactional email (Amazon SES), and AI audio generation and translation | All Customer Personal Data, including account user names and email addresses for transactional emails | Customer-selected hosting region (United States, Canada, European Union, Singapore or Australia). CDN edge locations worldwide | EU-US Data Privacy Framework; SCCs in AWS DPA |
| MongoDB, Inc. (MongoDB Atlas) | Database hosting for STQRY Chat | STQRY Chat conversation logs and related data | Same as the Customer's selected hosting region | EU-US Data Privacy Framework; SCCs |
| Akamai Technologies, Inc. (Linode) | Hosting for STQRY's self-hosted Matomo visitor analytics | Raw analytics events: IP addresses, device identifiers and usage events | United States (moving to Hetzner in the EU) | EU-US Data Privacy Framework (re-certification under review); SCCs |
| Hetzner Online GmbH | Hosting for web apps, websites and logging | Visitor IP addresses and request data; application and security logs | Germany | Within the EU, so no transfer safeguard is needed |
| BunnyWay d.o.o. (Bunny CDN) | Content delivery network and media storage | Customer Content media files; visitor request data (Bunny anonymises IP addresses in its logs) | Slovenia (EU) headquarters; storage in multiple regions and a global edge network | EU-based provider, so GDPR applies directly; edge locations outside the EU are covered by Bunny's DPA |
Service Sub-processors
These support specific parts of the Service and may access limited Customer Personal Data.
| Sub-processor | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Functional Software, Inc. (Sentry) | Application error monitoring | Technical data in error reports (IP address, device data, user ID) | United States | EU-US Data Privacy Framework; SCCs |
| OpenAI, L.L.C. | Generating answers to visitor questions in STQRY Chat | Visitor questions and conversation content, and the guide content used to answer them | United States | SCCs in OpenAI's DPA (not on the DPF list). Model training on STQRY data is turned off. |
| Anthropic, PBC | Generating answers to visitor questions in STQRY Chat | Visitor questions and conversation content, and the guide content used to answer them | United States | SCCs in Anthropic's DPA (not on the DPF list). Model training on STQRY data is turned off. |
| Eleven Labs, Inc. (ElevenLabs) | Generating audio narration from Customer Content | Customer Content text, and any voice recordings the Customer supplies to create a voice | United States | EU-US Data Privacy Framework; SCCs. Model training on STQRY data is turned off. |
| Mapbox, Inc. | Map display in apps and web apps | Visitor IP address, device data and the map area viewed | United States | EU-US Data Privacy Framework; SCCs |
| Stadia Maps, Inc. | Map tile delivery | Visitor IP address and the map area viewed | United States (standard endpoints) | SCCs in Stadia Maps' DPA (not on the DPF list) |
| Apple Inc. (MapKit and Apple Push Notification service) | Map display and push notifications in iOS apps | Visitor IP address and device data; device push tokens and notification content | United States and global | SCCs (not on the DPF list) |
| Freshworks Inc. (Freshdesk and Freshsales) | Customer support ticketing and help centre (Freshdesk); customer account and contact records (Freshsales) | Names, emails and content of support requests from account users; account user contact details | United States | EU-US Data Privacy Framework; SCCs |
| Google LLC (Google Maps Platform, Firebase Cloud Messaging and Google Workspace) | Map display; push notifications in Android apps; internal email and documents, where support or project communications contain Customer Personal Data | Visitor IP address and device data; device push tokens and notification content; account user contact details and content shared by the Customer | US and global | EU-US Data Privacy Framework; SCCs |
| Stripe, Inc. | Payment processing for content sales, credits and code redemptions | Purchaser name, email, transaction data | United States | EU-US Data Privacy Framework; SCCs |
| Chargebee, Inc. | Subscription billing and invoicing for STQRY customers | Customer billing contacts: names, email addresses, billing addresses and subscription details | United States | EU-US Data Privacy Framework; SCCs |
| Xero Limited | Accounting | Customer billing contacts: names, email addresses and invoice details | New Zealand company; data hosted on AWS in the United States | EU adequacy decision for New Zealand; SCCs in Xero's DPA for US hosting (not on the DPF list) |
| Slack Technologies, LLC (Salesforce) | Internal team messaging, where support or project discussions mention customers | Account user names and contact details; customer details shared in support discussions | United States | EU-US Data Privacy Framework; SCCs |
| Zapier, Inc. | Workflow automation between STQRY's business tools | Account user contact details and support or form data passed between tools | United States | EU-US Data Privacy Framework; SCCs |
| GitHub, Inc. | Source code hosting and issue tracking | Limited customer details that may appear in bug reports and support issues | United States | EU-US Data Privacy Framework; SCCs |
| Polaris Software, LLC (Benchmark Email) | Newsletters and marketing emails | Names, email addresses and organisations of customers and newsletter subscribers; email opens and clicks | United States | SCCs and UK Addendum in Benchmark's DPA (not on the DPF list) |
STQRY affiliates
| Entity | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| STQRY Limited (wholly owned subsidiary of OnCell Systems, Inc.) | Engineering, support and operations, including AI audio generation and translation on STQRY-owned servers | New Zealand | EU adequacy decision for New Zealand; UK adequacy regulations for New Zealand |
Not on this list
Third-party services that a Customer chooses to connect to its own apps (for example, its own Google Analytics property, ticketing system or mailing list) are engaged by the Customer, not by STQRY, and are not STQRY Sub-processors. Some vendors on this list (such as Benchmark Email, Chargebee and Xero) mainly support STQRY's own business, for example billing and newsletters. They are listed here for transparency, and STQRY's use of that data is explained in the STQRY Privacy Policy.
Change log
| Date | Change |
|---|---|
| 2 November 2026 | First published. |