This page lists the sub-processors HYPD Advertising Intelligence GmbH uses to provide the HYPD services, the recipients that receive data on our customers' instructions, and the providers that process data for which HYPD itself is the controller. It is the list referred to in our Data Processing Agreement (Annex 3) and our Privacy Policy.
Change notices. We publish every change on this page. Account owners receive an email at least 30 days before we add or replace a sub-processor that processes customer data, and may object within 14 days under § 5.5 of the DPA. To receive these notices at an additional address, write to privacy@hypd.ai.
Transfers. All customer data, connected platform data, prompts and AI processing are stored and processed in the EU. Where a provider is a US company, its support and administrative staff may access data from the USA; those transfers are covered by the EU Standard Contractual Clauses (SCC) and, where the provider is certified, the EU-US Data Privacy Framework (DPF).
1. Infrastructure and platform operation (sub-processors)
| Provider | Purpose | Location of processing | Transfer mechanism |
|---|
| Google Cloud EMEA Limited (Google Cloud Platform) | hosting, databases and infrastructure for the HYPD platform | Ireland; data centres in the EU | EU/EEA |
| Amazon Web Services EMEA SARL | hosting, databases and infrastructure for the HYPD platform | Luxembourg; data centres in the EU | EU/EEA |
| Railway Corporation | application hosting for the HYPD platform, running on Google Cloud in the EU | USA; data hosted in Google Cloud EU region | SCC, DPF |
| Vercel Inc. | hosting of the HYPD website and web application, Frankfurt region | USA; data processed in Frankfurt | SCC, DPF |
| PostHog, Inc. | product analytics for the HYPD application, EU Cloud, without persistent identifiers | USA; data stored in Frankfurt | SCC, DPF |
2. AI model providers used by HYPD (sub-processors)
| Provider | Purpose | Location of processing | Transfer mechanism |
|---|
| Google Cloud EMEA Limited (Vertex AI) | generation of analyses, summaries and recommendations with Gemini and Claude models; no training; transient retention for abuse monitoring only | EU regions | EU/EEA |
| Microsoft Ireland Operations Ltd. (Azure OpenAI) | generation of analyses, summaries and recommendations with OpenAI models; no training; retention up to 30 days for abuse monitoring | EU regions | EU/EEA |
| OpenAI Ireland Ltd. (API with EU data residency) | generation of analyses, summaries and recommendations with OpenAI models; no training; retention up to 30 days for abuse monitoring | EU regions | EU/EEA, parent company in the USA under SCC |
3. Recipients on the customer's instruction (independent controllers, not sub-processors)
| Provider | Purpose | Location |
|---|
| Google Ireland Limited | reading, analysing and, on the customer's approval, changing account and campaign data via the Google Ads, Google Analytics, Google Merchant Center, Google Search Console and Google Tag Manager APIs | Ireland |
| Meta Platforms Ireland Limited | reading and analysing account and campaign data via the Meta Marketing API | Ireland |
| LinkedIn Ireland Unlimited Company | reading and analysing account and campaign data via the LinkedIn Marketing API | Ireland |
| Microsoft Ireland Operations Ltd. | reading and analysing account and campaign data via the Microsoft Advertising API | Ireland |
| TikTok Technology Limited | reading and analysing account and campaign data via the TikTok Marketing API | Ireland |
| Operators of AI assistants the customer connects (for example Anthropic for Claude, OpenAI for ChatGPT) | receiving results HYPD returns into the customer's conversation; role determined by the customer's own agreement with the operator | per the customer's agreement |
4. Internal business operations (sub-processors with incidental access)
| Provider | Purpose | Location | Transfer mechanism |
|---|
| Google Ireland Limited (Google Workspace) | email, calendar, documents and collaboration; sees customer data only in support correspondence | Ireland | EU/EEA; group companies in the USA under SCC and DPF |
| Microsoft Ireland Operations Ltd. (Microsoft 365) | office, email and collaboration; sees customer data only in support correspondence | Ireland | EU/EEA; group companies in the USA under SCC and DPF |
| Slack Technologies Limited | internal team communication; sees customer data only in support correspondence | Ireland | EU/EEA; parent company Salesforce, USA, under SCC and DPF |
5. Providers for data HYPD controls itself
These providers process data for which HYPD is the controller, such as billing and support data. They are described in the Privacy Policy and are not sub-processors under the DPA.
| Provider | Purpose | Location |
|---|
| Stripe Payments Europe, Ltd. | payment processing and invoicing | Ireland |
| Featurebase OÜ | customer feedback and changelog portal | Estonia |
