The sub-processor list is now approved

The sub-processor list is no longer a draft. The page at /legal/subprocessors is now approved, and the draft banner is gone. Its version date is 2026-10-08.

It says what it covers. The list is for the free test version of the AI Shopping Assistant v3: the test account, the dashboard, the playground, the REST API, the MCP server, and the assistant served to shoppers when a test user enables it.

The notice period is fixed. We tell you at least 30 days before a new provider starts processing your data. The period can be shorter only when security, legal or operational reasons require it. This replaces the open point the earlier draft carried.

The Where column now states where each provider processes data, or says plainly that it is not published or not pinned. Most entries give a country, such as Frankfurt (Germany) or the United States. Where a provider publishes no processing location, or can process in several regions, the page says so in the cell instead of guessing.

A new Transfer safeguards section. For each provider whose data can leave the European Union, it lists the mechanism the provider publishes in its data processing agreement or privacy notice, as read in October 2026: EU-US Data Privacy Framework certification, standard contractual clauses, or none. It is explicit where there is none. For Linkup, we have signed no data processing agreement today. A provider can change its mechanism, and the page says so.

Starter question generation is now listed under OpenAI. When a test user asks the dashboard to generate starter questions for a page, OpenAI receives the page as a shopper sees it, plus your site's name, tone of voice and description. That processing is pinned to the European Union, like conversation labeling.