GDPR Article 28 — Third-Party Processor List
This page lists all third parties Zephra authorises to process personal data on your behalf, as required by GDPR Article 28. We will notify platform customers by email at least 14 days before adding any new sub-processor not already listed here.
| Sub-Processor | Service / Purpose | Location | Status |
|---|---|---|---|
| Infrastructure & Hosting | |||
| Google Cloud (Cloud Run) | Application hosting & execution | India (Mumbai) / Asia-Pacific | Active |
| Neon (PostgreSQL) | Database — platform & user data | Singapore / Asia-Pacific | Active |
| Cloudflare R2 | File & asset storage | Global | Active |
| Redis Cloud (Redis Labs) | In-memory cache & session state | India (Mumbai) / Asia-Pacific | Active |
| Netlify | Marketing website hosting (zephraai.com) | India (Mumbai) / Asia-Pacific | Active |
| Amazon Web Services (AWS) | Cloud infrastructure & compute | Global | Approved Pool |
| OVH Cloud | Cloud infrastructure & hosting | EU / Global | Approved Pool |
| Advertising Platforms | |||
| Google LLC | Ads management, OAuth authentication & conversion tracking | USA / Global | Active |
| Meta Platforms Inc | Ads management & server-side conversion tracking | USA / Global | Active |
| WhatsApp Business API (Meta) | Customer & notification messaging | USA / Global | Approved Pool |
| AI & Machine Learning | |||
| OpenAI | LLM inference — ad copy & content generation | USA / Global | Active |
| Groq Inc | LLM inference — low-latency generation | USA / Global | Active |
| Cerebras Systems | LLM inference — high-throughput generation | USA / Global | Active |
| Google DeepMind (Gemini) | Multimodal AI inference — content & image analysis | USA / Global | Approved Pool |
| Kling AI (Kuaishou Technology) | AI video generation | China / USA | Approved Pool |
| Seedance (ByteDance) | AI video generation | China / USA | Approved Pool |
| Analytics & Monitoring | |||
| Google Analytics 4 | Website analytics (consent-gated) | USA / Global | Active |
| Microsoft Clarity | UX heatmaps & session analysis (consent-gated) | USA / Global | Active |
| Sentry (Functional Software) | Application error monitoring — no PII collected | USA / Global | Active |
| MaxMind | IP geolocation (local database — no data sent externally) | USA / Global | Active |
| Communications | |||
| Twilio | SMS & communications delivery | USA / Global | Approved Pool |
For transfers outside the EEA/UK, we rely on EU Standard Contractual Clauses (2021 SCCs) and/or the EU–US Data Privacy Framework where applicable. See our Privacy Policy for full details. To object to any sub-processor or request the full DPA, contact hello@zephraai.com.