Sub-processors
This page lists the third-party sub-processors that Bubobot Company Limited (“we,” “us,” or “our”) engages to process personal data on behalf of users of the Amybot platform (“Platform”). This page is referenced by our Privacy Policy and Terms of Service.
For the purposes of this page, a “sub-processor” is any third-party entity that processes personal data on our behalf in connection with providing the Platform.
1. Infrastructure Sub-processors
These sub-processors provide core infrastructure services necessary to operate the Platform.
| Sub-processor | Purpose | Data Processed | Processing Location |
|---|---|---|---|
| Supabase, Inc. | Database hosting (PostgreSQL) and user authentication (Google OAuth) | Account information (name, email, profile picture), instance metadata, subscription records, authentication tokens | United States |
| Fly.io, Inc. | Application hosting — container orchestration for AI agent instances | Instance metadata, deployment configuration, resource allocation data | Global (region selected at deployment; default: US) |
2. Payment Sub-processor
Our designated payment processor acts as the merchant of record for all Platform transactions. By subscribing to the Platform, you also agree to the payment processor's terms of service.
| Sub-processor | Purpose | Data Processed | Processing Location |
|---|---|---|---|
| Paddle.com Market Ltd | Payment processing, subscription management, tax compliance, and invoicing (merchant of record) | Billing information (payment method, billing address), transaction records, subscription status, tax identifiers | United Kingdom / EU |
We do not store your full credit card number. Paddle collects and processes payment details directly. We receive only transaction identifiers, subscription status, and billing history from Paddle.
3. AI Model Providers
When your AI agents process data, relevant portions are transmitted to third-party AI model providers for inference (real-time response generation). The specific provider used depends on your agent configuration and model selection.
Data shared with AI model providers is:
- Limited to the context necessary for generating responses
- Used for real-time inference only — not stored by the provider for training purposes
- Transmitted encrypted in transit (TLS)
AI model access is provided through OpenRouter, Inc., an API gateway that routes requests to the model you select.
| Sub-processor | Purpose | Data Processed | Processing Location |
|---|---|---|---|
| OpenRouter, Inc. | AI model API gateway — routes inference requests to selected model providers | API key metadata, model selection, usage metering | United States |
| OpenAI, L.P. | AI model provider (GPT model family) | Prompt context and integration data submitted for inference | United States |
| Anthropic, PBC | AI model provider (Claude model family) | Prompt context and integration data submitted for inference | United States |
| xAI Corp. | AI model provider (Grok model family) | Prompt context and integration data submitted for inference | United States |
| Google LLC | AI model provider (Gemini model family) | Prompt context and integration data submitted for inference | United States |
| Meta Platforms, Inc. | AI model provider (Llama model family) | Prompt context and integration data submitted for inference | United States |
| DeepSeek | AI model provider (DeepSeek V3, DeepSeek R1) | Prompt context and integration data submitted for inference | China |
| Mistral AI | AI model provider (Mistral Large, Mistral Medium) | Prompt context and integration data submitted for inference | France / EU |
| Alibaba Cloud (Qwen) | AI model provider (Qwen model family) | Prompt context and integration data submitted for inference | China |
| MiniMax | AI model provider (MiniMax M1, M2.5) | Prompt context and integration data submitted for inference | China |
Important: You choose which AI model your agent uses. Data is only sent to the provider of the model you select. You are not required to use all listed providers.
4. User-Connected Integrations
The Platform allows you to connect third-party services to enable your AI agents to access and process data from those services. These integrations are initiated and authorized by you. Data is only collected from integrations you choose to connect, and only with your explicit consent (see Privacy Policy Section 5.2).
The third-party platforms in the table below are not traditional sub-processors — they are services you connect to the Platform. We include them here for full transparency about where your data flows.
| Integration Category | Examples of Platforms | Data Processed | Processing Location |
|---|---|---|---|
| Messaging platforms | Telegram, Discord, Slack, Zalo | Message content, conversation history, user/participant identifiers, channel/group information, message metadata (timestamps, IDs) | Varies by platform |
| Email services | Gmail, Outlook, other email providers | Email content, subject lines, sender/recipient addresses, timestamps, attachment metadata | Varies by platform |
| Productivity & collaboration tools | Google Workspace, Notion, Trello, Asana | Documents, notes, task descriptions, project data, comments, file metadata | Varies by platform |
| CRM & business tools | HubSpot, Salesforce, other CRM systems | Contact records, customer information, deal/opportunity data, interaction histories | Varies by platform |
| Social media platforms | Facebook Pages, Instagram, X (Twitter), LinkedIn | Posts, comments, interactions, profile information, engagement metrics | Varies by platform |
| File storage services | Google Drive, Dropbox, OneDrive | File names, file metadata, document content (when accessed by agents), folder structures | Varies by platform |
| Custom APIs & webhooks | User-configured API endpoints | Data payloads as configured by you, which may include any type of structured or unstructured data | Varies by endpoint |
Notes:
- The “Examples of Platforms” column is illustrative, not exhaustive. We may add support for new platforms within existing categories without updating this page.
- If we add an entirely new category of integration, we will update this page and, where required, obtain new consent.
- You control which integrations are connected. Disconnecting an integration stops all further data collection from that service.
- Data collected from integrations may contain personal information of third parties — see Privacy Policy Section 2.3 for your responsibilities.
5. Sub-processors We Do NOT Use
For clarity, we want to highlight services we do not use:
- We do not use advertising or tracking sub-processors. We do not engage any third party for ad targeting, behavioral tracking, or marketing analytics.
- We do not use data brokers. We do not sell or share personal data with data brokers.
- We do not use third-party analytics platforms (such as Google Analytics, Mixpanel, or Amplitude) that track individual user behavior.
6. Changes to Sub-processors
We will notify you at least 14 days before engaging a new sub-processor that will process your personal data. Notification will be sent via email to the address associated with your account.
If you object to a new sub-processor, you may contact us at privacy@amybot.ai within the 14-day notice period. We will work in good faith to address your concerns. If we cannot resolve your objection, you may terminate your subscription without penalty.
We will also update this page whenever sub-processors are added, removed, or materially changed. The “last updated” date at the top of this page reflects the most recent revision.
7. Data Processing Agreements
Each sub-processor listed on this page is bound by a data processing agreement that requires them to:
- Process personal data only on our documented instructions
- Implement appropriate technical and organizational security measures
- Notify us of any personal data breach without undue delay
- Delete or return personal data upon termination of services
- Comply with applicable data protection laws
8. Contact Us
For questions about our sub-processors, to object to a new sub-processor, or to request a copy of our data processing agreements, contact us at:
Bubobot Company Limited
D-00.03, Tower D, Sadora Building, No. 2, Street 13, An Khanh Ward, Ho Chi Minh City, Vietnam
Email: privacy@amybot.ai