Sub-processors
Updated 22 October 2026
The companies that help us run Behio and may process personal data while doing so. For each one we list what we use it for, where it processes data and which safeguard protects data that leaves the EU.
1. List of sub-processors
A sub-processor is a company that processes personal data for us, for example by hosting servers or sending e-mails. For merchants running a shop on Behio, these are also the sub-processors of their customers' data.
| Name | Purpose | Processing location | Safeguard |
|---|---|---|---|
| Hetzner Online GmbH | Application servers, database and backups, our own Behio Mail server and the Behio Analytics tool. | Germany | EU, no transfer |
| Cloudflare, Inc. | Content delivery (CDN), file and image storage, DNS, attack protection and cookieless website speed measurement. | USA; file storage in the EU, content delivery worldwide | DPF |
| Amazon Web Services, Inc. | Sending system and shop e-mails (Amazon SES) and processing their delivery status. | USA; processing in the EU (Frankfurt) | DPF |
| Google LLC | Firebase: sign-in and account verification, delivery of notifications to the mobile app. Google Places: address suggestions at checkout, where the merchant enables them. | USA | DPF |
| Stripe, LLC | Payments for Behio subscriptions and AI credits. | USA | DPF |
| OpenRouter, Inc. | Routing AI requests (the assistant Tom, chat replies, text generation) to the selected model, for example from OpenAI, Anthropic or Google. | USA | SCC |
| OpenAI, L.L.C. | AI models, the voice assistant Tom, translations and search in the chat knowledge base. | USA | SCC |
| Anthropic, PBC | Claude AI models for the assistant Tom and content generation, accessed through OpenRouter. | USA | SCC |
| Groq, Inc. | Speech-to-text for voice input. The audio is not stored. | USA | SCC |
| NexusAI Services LLC (kie.ai) | Image generation and editing in AI Photo Studio. | USA | SCC |
| Enable Banking Oy | Bank account connection (PSD2) for matching payments in invoicing, where you enable it. | Finland | EU, no transfer |
| GitHub, Inc. | Storage of the source code of websites and shops built on Behio. | USA | DPF |
| Salesforce, Inc. (Slack) | Internal notifications to the Behio team about new registrations, enquiries and support requests. | USA | DPF |
| Plus Five Five, Inc. (Resend) | Fallback sending of shop e-mails. | USA | DPF |
| Apple Inc. | Delivery of notifications to the Behio app on iPhone and iPad. | USA | SCC |
2. What the safeguards mean
- EU, no transfer: the provider processes data in the European Union, there is no transfer to a third country.
- DPF: the US provider is certified under the EU-US Data Privacy Framework, for which the European Commission adopted an adequacy decision (Implementing Decision (EU) 2023/1795). We check the certification at dataprivacyframework.gov/list.
- SCC: the transfer is protected by the standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914).
We will provide a copy of the safeguards on request at [email protected].
3. Services you connect with your own account
Some services are connected by the merchant with their own account, under their own contract. They are not our sub-processors, and we pass data to them only on the merchant's instruction:
- payment gateways connected to the shop (for example Stripe, GoPay, ComGate, PayPal),
- carriers and pickup points (for example Packeta, PPL, DPD, GLS),
- SMS gateways (for example GoSMS, Twilio) and your own e-mail provider (for example Resend, Mailgun),
- price comparison sites and marketplaces (for example Heureka, Zboží.cz, Alza), dropshipping suppliers and accounting systems,
- advertising and social networks the merchant pulls leads from (for example Meta).
4. Changes to this list
We notify merchants by e-mail at least 30 days before we add or replace a sub-processor, and we update this page at the same time. Within that period you can raise a reasoned objection at [email protected]. The details are set out in section 6 of the data processing agreement at behio.com/dpa.
How we handle personal data is described in the privacy policy at behio.com/privacy.