Subprocessors
Last updated: 2026-10-15
This page lists the third-party services that process data on our behalf (GDPR subprocessors), with their purpose and country. Written honestly - the real state of things, not marketing.
The important part about AI and your text
- The free QA validator runs every check on our own servers except the AI meaning check: for that one the segments' text goes to OpenRouter (up to 10 documents a day without an account).
- Conversations module. Mailboxes you connect are read live over IMAP and not stored by us: the database keeps only the fact that a reply arrived, when, and how it was classified. Your contacts are stored because you upload them. Reply text is sent to OpenRouter only while the "let AI read message content" switch is on - turn it off in settings and content never leaves our server. The spam check runs on our own server (rspamd) and is not sent anywhere.
- When you translate a document or run the AI checks, the text of the relevant segments (and, for scans, the page images) goes to OpenRouter, which passes it to an AI model provider. Nobody trains models on your documents, and they are never sold or shown to anyone. OpenRouter does not store the text of requests or answers (we keep its logging off). Some model providers hold a request for a limited time - 30 to 55 days, depending on the provider - only to detect abuse, then delete it automatically; others keep nothing at all. OpenRouter's policy: provider logging & training.
- Data is stored in the EU (Germany), on Hetzner Online GmbH infrastructure (ISO 27001).
- Auto-delete by default: for new accounts, uploaded documents and their translations are permanently deleted 30 days after upload. You can change the window or turn it off in Settings.
- We delete your data on request: help@chatscontrol.com. A Data Processing Agreement is on the DPA page.
Subprocessor list
| Subprocessor | Purpose | Country |
|---|---|---|
| Hetzner Online GmbH | Hosting, document and database storage, a daily database backup on the same server | Germany / Finland (EU) |
| OpenRouter, Inc. | Gateway to AI models: translation, scan recognition and the AI quality checks (text and page images are sent only for these; training on them is off) | United States |
| Mailgun Technologies, Inc. | Transactional email delivery (verification codes) | European Union |
| DeBounce LLC | Email address verification in Conversations - only the address is sent, and only when you ask for it | United States |
| Mailivery (Uptimize GmbH) | Mailbox warm-up in Conversations - optional, only for mailboxes you connect | Germany (EU) |
| Telegram (Telegram FZ-LLC, Telegram Messenger Inc.) | Notifications to our team: contact requests from the website forms (the name and contact details you submitted) and document processing failures (technical metadata only, no document content or file names) | UAE / British Virgin Islands |
| Google LLC (Analytics) | Website usage analytics (consent-based) | United States / EU |
| Functional Software, Inc. (Sentry) | Error monitoring - the error type and where it happened; no request bodies or variables, quoted text cut out | United States |
Payments are handled by a separate payment processor that has no access to your documents.
Changes
We will update this page and notify customers before engaging a new subprocessor, so the data controller can object (GDPR Art. 28(2)).
Questions? Email us at help@chatscontrol.com or on Telegram @mrbuslov.