OpsBots — providers and sub-processors

Self-drafted by CHK GmbH; not reviewed by a lawyer.

How to read this list

This list names every provider that receives personal data when OpsBots runs: what it receives, where, and in which role. It describes the service as set up on 24 October 2026. A provider is either CHK's processor or, for its own purposes, a controller (for example Stripe for payments); the role is named at each entry. The DPA governs CHK's processors; the privacy notice covers CHK's own purposes.

Switzerland recognises Germany, France, Ireland and the United Kingdom as countries with adequate data protection. For providers in the United States, the safeguard is named at each entry.

Render — hosting and database

• Company: Render Services, Inc., San Francisco, United States.
• Where: the OpsBots application and its PostgreSQL database run in Render's Frankfurt region, Germany. Render states that its own primary operations take place in the United States.
• What: everything OpsBots stores to provide the service: accounts, workspaces, uploaded files, website extracts, search vectors, conversations, contacts, consent records, mailbox connection data (access tokens encrypted), billing status and the audit log, and Render's technical logs.
• Role: CHK's processor.
• Kept at Render: database recovery copies for 3 days, manually created backups for 7 days, service logs for 7 days.
• Safeguard: Render's data processing addendum: the Swiss-U.S. Data Privacy Framework, or, where it does not apply, the EU standard contractual clauses adapted for Switzerland.

Anthropic — the AI model

• Company: Anthropic Ireland, Limited, Anthropic's contracting company for customers in Switzerland and the EEA; part of Anthropic, PBC, United States. Listed as Anthropic (US).
• Where: Anthropic stores the data in the United States. The model may run in any country where Anthropic provides it (Anthropic's standard global routing). No European hosting route, such as Amazon Bedrock in the EU, is used.
• What: for each answer or draft, the instructions, the knowledge excerpts found and the question, conversation or incoming e-mail. At setup, excerpts of your knowledge to suggest starter and test questions; for the monthly report, visitor questions to label their topics. Not: mailbox access tokens.
• Role: CHK's processor.
• Kept at Anthropic: inputs and outputs are deleted within 30 days, except where the law requires longer, and inputs and outputs flagged by Anthropic's automated safety checks for a usage-policy violation, which Anthropic keeps for up to 2 years. Anthropic's commercial terms do not allow it to train models on this content: "Anthropic may not train models on Customer Content from Services" (Commercial Terms of Service, section B, read 2026-10-27).
• Safeguard: Anthropic's data processing addendum, with the EU standard contractual clauses and a Swiss addendum.

Scaleway — search

• Company: Scaleway SAS, Paris, France (Generative APIs, model qwen3-embedding-8b).
• Where: a data centre in Paris, France.
• What: passages of your knowledge when they are imported, and each visitor question or incoming e-mail when it is searched; both are turned into search vectors. Vectors can contain personal information and are not treated as anonymous.
• Role: CHK's processor.
• Kept at Scaleway: nothing by default; a request involved in an error or suspected misuse may be kept for up to 2 weeks. Not used to train models: "Your data is not used for training, retraining, or improving the base models" (Generative APIs data privacy, read 2026-10-27).

Scaleway — OpsBots' e-mails

• Company: Scaleway SAS, Paris, France (Transactional Email).
• Where: Paris, France.
• What: the e-mails OpsBots sends: sign-up confirmations, password resets, security notices, invitations, billing notices, the welcome, setup tips and deletion warnings during a trial, notices that conversations are waiting for a person, usage warnings, the monthly report (figures only) and operator alerts, with recipient, sender, subject and text, including single-use links. This service does not read your mailbox.
• Role: CHK's processor.
• Kept at Scaleway: the e-mail itself until it is delivered or finally undeliverable; encrypted backups for 7 days; e-mails held back by a blocked receiving domain for 15 days; delivery records (recipient, sender, subject, sending IP address, times, delivery attempts and status) for as long as OpsBots' sending domain is active.

Stripe — payments

• Company: Stripe Payments Europe, Limited (Ireland), together with Stripe Payments UK Ltd (United Kingdom) for some payment services, as Stripe's agreement for Switzerland provides.
• Where: Ireland and the United Kingdom; Stripe may also process data in the United States and other countries under its own privacy notice.
• What: billing name and address, country, VAT number, card details (entered on Stripe's own page; OpsBots never sees the card number), plan, subscription, invoices and payment events. No knowledge, conversation or mailbox content.
• Role: Stripe decides on its own for payment processing, fraud prevention and its legal duties (a controller), and is a processor for particular services. Stripe's own privacy notice applies.

Google — only when you connect Gmail

Applies only when you authorise a Gmail connection (Pro plan and the trial). OpsBots then reads relevant messages and their metadata and writes reply drafts into that mailbox; it never sends e-mail. Google is your own mailbox provider: its role and locations follow your Google account's agreement. The connection's access token is stored encrypted at Render.

Meta — only when a WhatsApp number is connected

WhatsApp is not offered to customers yet; CHK tests it on its own demo workspace. Once it is offered, this entry applies only when a business connects its WhatsApp number.

• Company: Meta Platforms (WhatsApp Business Platform, Cloud API).
• What: delivers WhatsApp messages between the business and its customers: message text, profile name, phone number and delivery status.
• Where: Meta's data centres; Meta's Cloud API page does not name the countries.
• Role: the business's own processor, under the terms the business accepts with Meta when it connects the number (Meta's hosting terms for the Cloud API, with Meta's data-transfer addendums); not CHK's sub-processor.
• Kept at Meta: message data for at most 30 days. Meta does not use Cloud API messages to choose ads.
• Fees: Meta bills them to the business directly.

Infomaniak — domain and support mailbox

• Company: Infomaniak Network SA, Geneva, Switzerland.
• What: e-mails you send to support@opsbots.ch and our replies. The opsbots.ch domain and its DNS are also managed there.
• Where: Switzerland.
• Role: CHK's processor for its support e-mail.

Website hosting

Render (Render Services, Inc., United States; see above) also hosts the opsbots.ch website as a static site. Render delivers it through its global content delivery network, so a page may be served from a server near the visitor, inside or outside Europe. The website sets no cookies and has no analytics or tracking; delivering a page needs the visitor's IP address. Our chat on the website, with its contact form, runs on app.opsbots.ch (Render, see above) and is described in the privacy notice. Render provides no access logs for static sites to CHK; Render's own technical records follow Render's privacy notice.

Not used

OpsBots uses no analytics, advertising, error-tracking or external font service. Outlook (Microsoft) is not available yet. For WhatsApp, see the Meta entry above. Before any data goes to a new provider, it is added to this list with 30 days' notice under the DPA.

Changes and requests

Changes to CHK's processors follow the DPA's 30-day advance notice and objection procedure. Ask support@opsbots.ch for the agreements and transfer safeguards behind this list.