Sub-processors
Tuxon processes personal data on behalf of the businesses that use the platform. These businesses are the data controllers; Tuxon acts as a data processor. To run the Service we use the third-party providers ("sub-processors") listed below. This page is published for transparency and forms part of our Data Processing Agreement.
Current sub-processors
| Provider | Purpose | Data involved | Location |
|---|---|---|---|
| Hetzner Online GmbH | Cloud hosting and infrastructure | All platform data at rest | Germany (EU) |
| OpenAI (OpenAI Ireland Ltd. for customers in the EEA/Switzerland) | AI reply generation, text embeddings, and voice-message transcription | Message content, knowledge-base content, contact details, voice notes | EEA contracting entity. Processed in the United States by default, under Standard Contractual Clauses. EU data residency is available on request. |
| Meta Platforms Ireland Ltd. | WhatsApp, Facebook Messenger, and Instagram messaging | Message content, page-scoped IDs, profile name, timestamps | EEA contracting entity; global infrastructure |
| 360dialog GmbH | WhatsApp Business messaging | Phone numbers, message content | Germany (EU) |
| Twilio Inc. | SMS and WhatsApp message delivery | Phone numbers, message content | United States (Standard Contractual Clauses) |
| Telegram | Telegram messaging | Message content, Telegram user identifier | Global |
| Google Ireland Ltd. | Sign-in (OAuth) and Google Sheets / Drive export | Name, email address, exported data | EEA contracting entity; global infrastructure |
| Resend (Plus Five Five, Inc.) | Transactional and notification email delivery | Email address, message content | United States (Standard Contractual Clauses) |
| Google (Firebase Cloud Messaging) | Mobile push notifications | Device token, notification content | United States (Standard Contractual Clauses) |
International transfers
Where a sub-processor processes data outside the European Economic Area, the transfer is covered by appropriate safeguards under Article 46 GDPR — in practice, the European Commission's Standard Contractual Clauses, or an adequacy decision. Where available, we use the EU contracting entity of the provider (for example OpenAI Ireland Ltd. and Meta Platforms Ireland Ltd.).
Changes to this list
We may add or replace sub-processors as the Service evolves. Material changes will be reflected on this page with an updated date. Customers with a Data Processing Agreement are notified in line with the terms of that agreement.
Contact
Questions about our sub-processors or data protection may be sent to support@tuxon.ai.