Sub-processor List
Chatstat Pty Ltd (ABN 72 651 491 637, ACN 651 491 637)
Last updated: July 15, 2026
Sub-processors are third-party providers that process personal information on Chatstat's behalf to help us deliver the service. This page lists our current sub-processors, what they do for us, and where they process data. Each name links to the provider's own privacy policy.
This list does not include recipients that a customer directs us to send data to. Where an enterprise customer connects its own AI tools through our API or MCP server, the AI provider the customer chooses (for example, Anthropic where a customer connects Claude) acts on that customer's instruction, subject to the tier controls described in our Privacy Policy.
Current sub-processors
| Provider | Purpose | Data categories | Location / region |
|---|---|---|---|
| Amazon Web Services | Application hosting and file storage | All service data | Australia (Sydney, ap-southeast-2) |
| Supabase | Managed database, authentication, and row-level security enforcement | All service data | Australia (Sydney, ap-southeast-2) |
| Microsoft Azure OpenAI Service | AI content analysis, AI Guide and assistant responses, support knowledge-base answers, summaries, and embeddings. Microsoft's terms provide that customer data is not used to train foundation models | Content submitted for analysis per the tier controls; AI Guide inputs | United States (East US 2) |
| Google Gemini API | AI analysis of video content, including YouTube. Usage is on Google's paid tier (verified against billing records), under which Google's terms provide that prompts and responses are not used to train models | Video content submitted for analysis | Global (Google infrastructure) |
| HubSpot | Customer relationship management, support, and communications, receiving limited account holder fields from the parent app: contact details, sign-up and onboarding status, subscription status, and marketing attribution. No monitored content or child data is synced | Contact details, support history, account and subscription status, marketing attribution | United States |
| Microsoft Clarity | Session analytics and heatmaps on the marketing homepage and the family dashboard, with strict masking on authenticated surfaces | Masked session interaction data, device and usage data | United States |
| Google (Tag Manager, Analytics 4) | Website analytics | Device and usage data | United States |
| Google reCAPTCHA Enterprise | Bot and abuse protection on sign-in and forms | Device and interaction signals, IP address | United States |
| Google Firebase Cloud Messaging and Expo | Delivery of mobile and web push notifications | Device push tokens, notification payloads | United States / global |
| Social data access providers (via the RapidAPI platform and Bright Data Scraper APIs) | Retrieval of publicly available social media content for registered public accounts | Registered public handles, returned public content | Bright Data Ltd: Israel and global infrastructure; RapidAPI providers: United States and other regions |
| Paddle | Payment processing and subscription billing | Billing details, payment instrument data (held by the processor, not Chatstat) | United States / United Kingdom |
| Apple App Store and Google Play | App store subscription billing and receipt validation | Purchase and subscription records | United States / global |
| Microsoft 365 | Business email and delivery of system and alert emails, sent from noreply@chatstat.com | Email address, notification content | Global (Microsoft network) |
| Klaviyo | Customer email and lifecycle messaging | Contact details, engagement data | United States |
| Apollo | Sales and outreach contact management | Business contact details | United States |
| Webflow | Marketing website hosting and website form submissions | Website usage data, contact and careers form submissions | United States |
International transfers
Where personal data is transferred outside its region of origin, we rely on appropriate safeguards, including Standard Contractual Clauses for transfers from the EU and the UK International Data Transfer Addendum for transfers from the United Kingdom. Customers who configure Australian or EU hosting can restrict primary processing to those regions, subject to the global nature of certain analytics and billing providers noted above.
Changes to this list
We update this page when we add, remove, or materially change a sub-processor. Enterprise customers under a Data Processing Addendum receive advance notice of new sub-processors in line with the notice period in their agreement, and may object on reasonable data-protection grounds.
To subscribe to change notifications, contact privacy@chatstat.com with the subject line "Sub-processor notifications."
Contact
Questions about this list: privacy@chatstat.com
Chatstat Pty Ltd, Queensland, Australia
