Legal
Subprocessors
The service providers ChatUno uses to deliver the service, what they receive and where they process it. This is the list our data processing agreement refers to.
Current subprocessors
Each provider below processes personal data for ChatUno only to deliver the part of the service described, under written data protection terms. ChatUno stays responsible to you for their work, as set out in our data processing agreement.
| Provider | Purpose | Personal data | Location |
|---|---|---|---|
| Supabase | Database, sign-in, file storage and the encrypted secret store | All account, workspace and end-customer data stored in ChatUno, including chats, contacts, bookings, uploaded media, visitor tracking records and access tokens for connected accounts (encrypted) | United States (AWS us-east-2, Ohio) |
| Railway | Hosting for the website, the API, the AI service, the video renderer, the message queue and the nightly backup job | All data passing through the service while it is processed; queued messages; operational logs with personal details removed | United States (eastern US) |
| Cloudflare | DNS for chatuno.ai; network proxy and cache in front of www.chatuno.ai (the website, the dashboard and the widget script); the bot check on sign-up, sign-in, waitlist and support forms; storage for encrypted database backups | IP address and request details of everyone who loads www.chatuno.ai or the widget script; form visitors' browser signals for the bot check; database backups, encrypted by us before upload so Cloudflare cannot read them | Global network; backups in Cloudflare R2 |
| Anthropic | Generating assistant replies, drafts and analyses (the default model provider for text) | Visitor and Instagram messages with conversation history, knowledge-base passages, captions, comments and other business content needed for the answer | United States |
| OpenAI | Search embeddings for the knowledge base, image generation and editing, and text generation where a model tier is set to OpenAI | Knowledge-base passages; image prompts and the reference images you choose; the same message content as Anthropic when it generates text | United States |
| Google (Gemini API) | Reel and post analysis, image generation and AI video clips with Google models | Frames or cover images of the connected account's posts and Reels, captions and metrics; prompts and the reference images you choose | United States / global |
| fal | AI video clips, voice-overs and "use my face" talking videos with the video models offered in the Studio | Prompts, scripts and the reference images you choose; for a talking video, the photo of the person and the generated voice | United States |
| Resend | Transactional and workflow email | Recipient name and email address, email content (booking confirmations, team alerts, email flows and approved outreach), delivery and bounce events | United States |
| Google (sign-in, Calendar, Gmail, Places) | Google sign-in, Calendar sync, sending email from a connected Gmail account, business search for prospect research | Account name and email; booking name, email and time written to the connected calendar; outgoing email; business search queries | United States / global |
| Meta (Instagram) | Instagram messages, comments, insights and publishing for accounts you connect | Instagram-scoped IDs, usernames, messages and comments sent to the connected account, and the replies and posts you approve | United States / global |
| Sentry | Error tracking, used only when it is switched on for a service | Error details and request context, with personal details and secrets removed before they leave our servers | United States |
AI providers receive only what a task needs. Under their business API terms, Anthropic, OpenAI and Google do not use this data to train their models; they may keep it for a limited period to detect abuse before deleting it. ChatUno does not train its own models on your data. Some video models offered through fal are built by other companies; fal handles the request under its own terms.
Website visitor tracking
When you switch on Visitor Tracking, only these providers handle the tracking data. No AI provider receives it.
| Provider | What it does with tracking data |
|---|---|
| Cloudflare | Serves the widget script, and answers the widget's country lookup (www.chatuno.ai/api/geo) used to decide whether to show the consent banner. It sees the visitor's IP address in transit; ChatUno receives only the country code and does not store it. |
| Railway | Runs api.chatuno.ai, which receives the tracking events the widget sends after consent (or under the mode you chose) and rejects events from browsers that send Do Not Track or Global Privacy Control. |
| Supabase | Stores the events, visits and visitors (random ID, page addresses and titles, clicks, time active, shop steps, a salted one-way hash of the IP address) and each visit's consent basis. Deleted automatically after 180 days. |
Transfers outside Türkiye, the EEA and the UK
ChatUno and the providers above process data in the United States. For data covered by the GDPR or the UK GDPR, transfers to ChatUno rely on the EU Standard Contractual Clauses (and the UK addendum) incorporated in our data processing agreement, and onward transfers to these providers rely on the Standard Contractual Clauses in their data processing terms and, where a provider is certified, the EU-U.S. Data Privacy Framework.
For data covered by Turkish law (KVKK), sending it to ChatUno is a transfer abroad under Article 9 of Law No. 6698 as amended in 2024. ChatUno will sign the Personal Data Protection Board's standard contract with you on request, and you notify it to the Authority within five business days of signature, as the law requires.
Changes
We will update this page and email account owners at least 30 days before a new subprocessor starts receiving personal data. You may object on reasonable data protection grounds within that period, as described in the data processing agreement. Questions: info@chatuno.ai.
- October 27, 2026: published as the list in force. Added Cloudflare's proxy for www.chatuno.ai and its country lookup, fal, and the website visitor tracking section.