List of sub-processors
Last updated: a completer : publication date
1. Purpose of this page
Reponse is a service published and operated by Shmore (see section 22). When you use Reponse, we process personal data on your behalf, whether that data relates to you or to your own customers: you act as the controller, we act as the processor within the meaning of Article 28 GDPR.
To deliver the service, we rely on technical providers that also process this data. These are sub-processors. This page lists them as at the date stated at the top. It is updated in accordance with the procedure set out in section 2.
This page serves three purposes:
- It constitutes the general written authorisation provided for in Article 28(2) GDPR: by accepting our data processing agreement (a completer : existence, reference and URL of the data processing agreement (DPA)), you authorise the use of the sub-processors listed here.
- It may be annexed as is to that data processing agreement. The binding version is the one published at this page's address on the date stated at the top.
- It allows you to track changes and, where relevant, to object to them following the procedure set out in section 2.
This page does not replace our privacy policy (a completer : URL of the privacy policy), which describes the processing for which we act as controller (account, billing, website). Nor does it replace our legal notice (a completer : URL of the legal notice page) or the terms applicable to the service (a completer : URL of the terms of service).
2. How you are informed of a change
We may add, replace or remove a sub-processor, for example for technical, security, cost or service continuity reasons.
**Publication.** Any change is published on this page, with the date at the top updated and an entry added to the version log in section 21.
**Prior notice.** Before adding or replacing a sub-processor, we intend to notify workspace administrators by email, at the address recorded in the account, at least a valider : notice period, 30 calendar days proposed before the change takes effect. a valider : notification channel actually in place and account field holding the administrators' address.
**Subscribing to notifications.** To receive these notifications at a dedicated address (for example a legal or security mailbox), write to hello@reponse.ai with the subject "Sub-processor notifications", stating the address to register, or use a completer : URL of the notification subscription form or list. You may unsubscribe at any time through the same channel, it being specified that unsubscribing does not relieve you of the need to consult this page.
**Objection.** You may object to the addition of a new sub-processor on reasonable and documented data protection grounds, within a valider : objection period, 15 calendar days proposed of the notification, by email to hello@reponse.ai. We review the objection and look in good faith for a reasonable alternative. If no solution can be found within a reasonable time, you may terminate the affected part of the service, or the subscription, under the conditions set out in the contract. Our refund policy (full refund within 14 days on simple request to hello@reponse.ai) continues to apply on its own terms.
**Exception.** Where a sub-processor must be replaced urgently, in particular for security reasons or because of a provider's failure or discontinuation of service, we may proceed without observing the notice period. We then inform you as soon as reasonably possible and you retain your right to object.
3. How to read the tables
For each sub-processor, the tables state:
- Sub-processor: the provider's name. The exact legal name and address of the contracting entity are given below each table.
- Role in the service: the function it performs. We seek to limit the data sent to each sub-processor to what is necessary for that function. a valider : effective access segregation per sub-processor and actual scope of the data transmitted.
- Data categories: the types of personal data that may be processed.
- Processing location: the country or region where data is hosted or processed. Where we cannot state this with certainty, an a valider : region marker flags it and the statement must be confirmed with the provider before publication.
- Transfers outside the EU: the legal mechanism applicable where data leaves the European Union. See section 6.
We distinguish two categories:
- standard sub-processors (section 4), which may be involved for any customer, on any plan, including the free plan. Some of them are however involved only if the corresponding feature is used, for example the payment provider where there is no paid subscription. a valider : list of sub-processors actually involved on the free plan;
- customer-activated sub-processors (section 5), involved only if you activate the corresponding integration yourself from your workspace.
4. Standard sub-processors
4.1 Hosting and infrastructure
| Sub-processor | Role in the service | Data categories | Processing location | Transfers outside the EU |
|---|---|---|---|---|
| Supabase | Primary database, user authentication, file storage | Account and authentication data (name, email, technical identifiers), conversation and ticket content, CRM contact records, customer reviews, loyalty and referral data, catalogue and orders, attachments, technical logs | a valider : hosting region of the Supabase project | See section 6, a valider : applicable transfer mechanism |
| Netlify | Hosting of the website, the application and the server functions | Data transiting through requests (form and API call content), IP addresses, request headers, technical logs | a valider : Netlify processing region | See section 6, a valider : applicable transfer mechanism |
Contracting entities:
- Supabase: a completer : legal name and address of the Supabase contracting entity
- Netlify: a completer : legal name and postal address of the Netlify contracting entity
4.2 Artificial intelligence models
The providers below are used through multi-provider routing: depending on the task, the language, availability and cost, a request may be sent to one or another. See section 10 for details on this processing.
| Sub-processor | Role in the service | Data categories | Processing location | Transfers outside the EU |
|---|---|---|---|---|
| OpenAI | Generation of AI agent replies, classification and assisted drafting | Content of messages submitted to the agent, excerpts of the knowledge base, catalogue and orders used as context, instructions configured by the merchant | a valider : OpenAI processing region | See section 6, a valider : applicable transfer mechanism |
| Generation of AI agent replies, alternative processing depending on routing | Same categories as above | a valider : Google processing region | See section 6, a valider : applicable transfer mechanism | |
| Mistral | Generation of AI agent replies, alternative processing depending on routing | Same categories as above | a valider : Mistral processing region | See section 6, a valider : applicable transfer mechanism |
Contracting entities:
- OpenAI: a completer : legal name and address of the OpenAI contracting entity
- Google: a completer : legal name and address of the Google contracting entity
- Mistral: a completer : legal name and address of the Mistral contracting entity
a valider : model providers actually called in production and routing rules between them.
4.3 Payments
| Sub-processor | Role in the service | Data categories | Processing location | Transfers outside the EU |
|---|---|---|---|---|
| Stripe | Payment and invoicing of Reponse subscriptions, where you take out a paid subscription | Subscriber identity and contact details, billing address, card or payment method data, transaction history | a valider : Stripe processing region | See section 6, a valider : applicable transfer mechanism |
| Stripe | Collection of payments for orders placed with the merchant, where the merchant activates and uses this feature | Buyer identity and contact details, order amount and details, payment data | a valider : Stripe processing region | See section 6, a valider : applicable transfer mechanism |
Contracting entity: a completer : legal name and address of the Stripe contracting entity.
Scope: the first row concerns only workspaces that have taken out a paid subscription. The second row relates to a feature activated by the merchant and is therefore subject to the regime described in section 5.
a valider : card data is collected directly by Stripe and does not transit through our servers.
Note: for the payment data it collects and retains on its own account, in particular under its regulatory anti-fraud and anti-money-laundering obligations, Stripe may act as an independent controller and not as our sub-processor. a valider : exact qualification to be confirmed against the applicable Stripe contract.
4.4 Email and related webhooks
| Sub-processor | Role in the service | Data categories | Processing location | Transfers outside the EU |
|---|---|---|---|---|
| Resend | Sending of transactional emails and outbound emails from the service | Sender and recipient email addresses, subject and body of the message, attachments where applicable, deliverability metadata (sent, delivered, failed) and, where applicable, engagement metadata a valider : whether open and click tracking is enabled | a valider : Resend processing region | See section 6, a valider : applicable transfer mechanism |
| Amazon SES | Email routing a valider : exact split between Resend and Amazon SES, complementary use, failover or replacement | Same categories as above | a valider : AWS region used | See section 6, a valider : applicable transfer mechanism |
| Svix | Processing of email event webhooks a valider : exact role of Svix, signing only or signing and delivery | Email event metadata (event identifier, timestamp, delivery status, email address concerned) contained in the transmitted payload | a valider : Svix processing region | See section 6, a valider : applicable transfer mechanism |
Contracting entities:
- Resend: a completer : legal name and address of the Resend contracting entity
- Amazon SES: a completer : legal name and address of the Amazon Web Services contracting entity
- Svix: a completer : legal name and address of the Svix contracting entity
4.5 Product analytics
| Sub-processor | Role in the service | Data categories | Processing location | Transfers outside the EU |
|---|---|---|---|---|
| PostHog | Audience measurement and analysis of product and website usage | Technical identifier assigned to the visitor or user, usage events (page views, actions in the interface), browser and device information, IP address a valider : collection and possible anonymisation of the IP address by PostHog | a valider : PostHog processing region | See section 6, a valider : applicable transfer mechanism |
Contracting entity: a completer : legal name and address of the PostHog contracting entity.
Trackers and audience measurement on the website are subject to the consent banner. Your choice is stored in your browser under the `cookie_consent` key and can be changed at any time. a valider : exact scope of the measurement subject to consent and of what is treated as strictly necessary.
5. Sub-processors activated only at your request
The providers below are involved only if you activate the corresponding integration from your workspace. Activation constitutes your instruction to transmit the data concerned. As long as the integration is not activated, Reponse does not send them data as part of the service. a valider : absence of any outbound call to these providers without activation.
| Sub-processor | Role in the service | Data categories | Processing location | Transfers outside the EU |
|---|---|---|---|---|
| Shopify | Store synchronisation: catalogue, orders, customers, commerce events | Identity and contact details of store customers, shipping and billing addresses, order content and status, catalogue data | a valider : Shopify processing region | See section 6, a valider : applicable transfer mechanism |
| Klaviyo | Synchronisation of contacts and events towards your marketing campaigns | Contact identity and details, email addresses, usage and order events transmitted | a valider : Klaviyo processing region | See section 6, a valider : applicable transfer mechanism |
| Notion | Content synchronisation, in particular knowledge base and pages used by the service | Content of synchronised pages, which may contain personal data depending on what you place there | a valider : Notion processing region | See section 6, a valider : applicable transfer mechanism |
| TikTok Shop | Synchronisation of orders and messages from the TikTok Shop store | Buyer identity and contact details, order content and status, messages exchanged | a valider : TikTok Shop processing region | See section 6, a valider : applicable transfer mechanism |
| Stripe | Collection of payments for orders placed with the merchant, where this feature is activated (see section 4.3) | Buyer identity and contact details, order amount and details, payment data | a valider : Stripe processing region | See section 6, a valider : applicable transfer mechanism |
Contracting entities:
- Shopify: a completer : legal name and address of the Shopify contracting entity
- Klaviyo: a completer : legal name and address of the Klaviyo contracting entity
- Notion: a completer : legal name and address of the Notion contracting entity
- TikTok Shop: a completer : legal name and address of the TikTok Shop contracting entity
When you activate an integration, the provider concerned may also act as a controller for its own purposes, under the contractual relationship you hold directly with it. That relationship falls outside our data processing agreement. a valider : allocation of roles for each integration.
6. Transfers outside the European Union
Some of the sub-processors listed above may process data outside the European Union, in particular in the United States.
At this stage we cannot state for each provider the exact location of the processing or the transfer mechanism relied upon. Every row in the tables above therefore carries a marker to be validated.
a completer : for each sub-processor, state the applicable mechanism, for example European Commission standard contractual clauses, an applicable adequacy decision, supplementary technical and organisational measures, and the reference of the signed contractual document.
We claim no certification and no compliance label. We do not guarantee that data remains at all times within the European Union, unless expressly stated and validated in the tables above.
On written request to hello@reponse.ai, we share with the customer the information we hold on the transfer mechanism applicable to a given sub-processor.
7. Location of data at rest and in transit
This section is distinct from the transfer mechanism addressed in section 6: it concerns where the data is physically held.
- Data at rest (primary database, files, backups): a completer : storage regions at rest for the database, file storage and backups.
- Data in transit: a valider : encryption protocol for exchanges between the browser, our application and each sub-processor.
- Replicas and caches, if any: a completer : existence, location and lifetime of replicas, caches and queues.
We do not state that all processing is located within the European Union. The regions actually used must be filled in above before publication.
8. Obligations imposed on our sub-processors
In accordance with Article 28(4) GDPR, our rule is to ensure that each sub-processor is subject to data protection obligations substantially equivalent to those binding us to you, in particular:
- processing data only on documented instructions and for the intended purpose;
- ensuring the confidentiality of persons authorised to access the data;
- implementing appropriate technical and organisational measures;
- assisting us with data subject requests and personal data breaches;
- deleting or returning data at the end of the engagement.
Where these obligations arise from the provider's standard terms rather than from a negotiated agreement, it is that standard document that applies.
We remain liable to you for the performance of our sub-processors' obligations, within the limits set out in the contract entered into with you.
a valider : existence, reference and date of a data processing agreement signed or accepted with each of the listed providers.
9. Security measures
We claim no certification, no external audit and no security label.
The technical and organisational measures implemented under Article 32 GDPR are described in a completer : reference and URL of the document describing the security measures. In the absence of that document, the following items remain to be documented before any statement is made to a customer:
- a completer : internal access and permission management
- a completer : encryption at rest and in transit
- a completer : logging, monitoring and incident detection
- a completer : backups, restore testing and continuity plan
- a completer : vulnerability and patch management
- a completer : staff awareness and confidentiality undertakings
We undertake to state, in response to a security question, only measures that are actually implemented and verifiable.
10. Processing by artificial intelligence models
When the AI agent is used, the content of conversations and the necessary context (knowledge base, catalogue and order excerpts, merchant instructions) is transmitted to the model provider selected by the routing in order to produce the reply.
We do not train models on our customers' data. We are not in a position to guarantee the behaviour of each provider beyond its own contractual undertakings. a valider : contractual no-training undertaking on the transmitted data, for each provider. a valider : retention period for requests and responses on the provider's side.
We recommend not submitting to the agent any special category data within the meaning of Article 9 GDPR.
11. Retention periods applicable to the service and passed on to our sub-processors
The periods below are those applicable to the service. The actual retention periods on each provider's side, in particular for logs and backups, remain to be validated: a valider : retention period specific to each sub-processor, in particular logs, queues and backups.
Automated purge jobs are in place, in particular the deletion of dormant free workspaces.
Proposed periods, to be validated before publication:
- dormant free workspace: deletion after a valider : inactivity period triggering the purge, 12 months proposed;
- conversations and tickets: retained for the term of the contract, then deleted within a valider : deletion period after the end of the contract, 30 days proposed;
- technical logs: a valider : retention period for technical logs, 12 months proposed;
- billing records: statutory accounting retention period, a valider : applicable statutory period, 10 years proposed.
**Backups and disaster recovery copies.** Data deleted from the live database may temporarily remain in backups. a completer : backup location, frequency, retention period and maximum time for a deleted record to be purged. Until these items are filled in, we cannot commit to a definitive purge deadline.
12. Audit and documentation, Article 28(3)(h) GDPR
On written request to hello@reponse.ai, we make available the information we hold to demonstrate compliance with our Article 28 obligations, in particular this list, the security documentation referred to in section 9 and the transfer mechanism information referred to in section 6.
Audit arrangements: a completer : arrangements and frequency for audits or inspections, notice period, scope, auditor confidentiality undertaking, allocation of costs.
In the absence of agreed arrangements, the provision of documentation described in the first paragraph is our default response to an audit request. a valider : acceptability of this limitation under Article 28(3)(h).
13. Personal data breaches, Articles 28(3)(f) and 33 GDPR
In the event of a breach affecting personal data processed on your behalf, we undertake to inform you without undue delay after becoming aware of it, so that you can meet your own notification obligations.
- Notification deadline: a valider : period for informing the customer after becoming aware, 72 hours proposed.
- Channel: email to the workspace administrators' address and, where applicable, to the dedicated address registered under section 2. a valider : notification channel actually in place.
- Content: nature of the breach, categories and approximate volume of data and data subjects concerned, likely consequences, measures taken or envisaged, point of contact.
As the controller, it is for you to decide whether to notify the supervisory authority and, where applicable, the data subjects.
a completer : internal breach management procedure, point of contact and associated register.
14. Assistance with data subject rights, Article 28(3)(e) GDPR
Requests for access, rectification, erasure, restriction, objection and portability relating to data we process on your behalf must be addressed to you: you are the controller.
If we receive such a request directly in relation to data processed on your behalf, we do not answer it on the merits ourselves. We forward it to the administrator of the workspace concerned and inform the requesting individual. a valider : forwarding procedure and time frame.
We assist you, as far as possible and taking into account the nature of the processing, through the features available in the product and, where necessary, through manual handling. a completer : export and deletion features available in the product, and any charge for manual assistance.
15. End of the contract and fate of the data, Article 28(3)(g) GDPR
At the end of the contract, at your option expressed in writing to hello@reponse.ai:
- return of the data in a a completer : export formats offered format, within a valider : period for making the export available, 30 days proposed of the request;
- or deletion of the data within a valider : deletion period after the end of the contract, 30 days proposed, subject to the backups referred to in section 11 and to data we are required to retain under a legal obligation, in particular accounting rules.
If no option is expressed within that period, we proceed with deletion. a valider : default behaviour retained and prior information given to the customer.
16. End data subjects, the merchants' own customers
If you are an end customer of a store using Reponse and wish to exercise your rights over your data, contact the merchant you ordered from or exchanged messages with. That merchant is the controller. We act only on its instructions and cannot, on our own initiative, modify or delete its data.
If you write to us directly at hello@reponse.ai, we forward your request to the merchant concerned and inform you accordingly, without handling the request on the merits.
17. Reponse staff, affiliates and support providers
Members of the Reponse team who may access data processed on your behalf do so for the operation, support and maintenance of the service, and are bound by a confidentiality obligation. a completer : formalisation of this confidentiality undertaking and management of access rights.
a valider : existence of affiliates, subsidiaries or group entities accessing the data.
a valider : existence of support providers, outsourced support, development contractors or freelancers accessing the data. If any such parties exist, they must be added to the tables above.
18. Complaints, supervisory authority and mediation
You may lodge a complaint with the French data protection authority, Commission nationale de l'informatique et des libertes (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.
If you are a consumer within the meaning of the French Consumer Code, you may refer the matter free of charge to a consumer mediator: a completer : name and contact details of the consumer mediator. The European online dispute resolution platform is available at ec.europa.eu/consumers/odr.
For non-professional subscribers, our full refund within 14 days on simple request to hello@reponse.ai applies on its own terms and without prejudice to statutory rights, in particular the right of withdrawal where applicable. a valider : exact articulation between the 14-day refund policy and the statutory right of withdrawal.
19. Contact
For any question about this list, to subscribe to change notifications, to raise an objection or to request a copy of the documentation relating to a sub-processor:
- general email: hello@reponse.ai
- support: support@reponse.ai
- data protection point of contact: hello@reponse.ai, with the subject "Data protection"
- data protection officer: a completer : existence and contact details of the data protection officer, if any. Where none is appointed, the point of contact above remains the single point of contact
- postal address: Shmore, 26 Thubert, 44118 La Chevrolière, France
- telephone: a completer : telephone number
20. Governing law and jurisdiction
This page and the contractual annex it constitutes are governed by French law. a valider : governing law chosen in the main contract, for consistency.
Jurisdiction: a completer : competent courts as provided in the main contract. This clause does not deprive a consumer of the rules of jurisdiction that apply to them as of right.
21. Version log and access to earlier versions
| Version | Date | Change |
|---|---|---|
| 1.0 | a completer : publication date | Initial publication of the list |
Any later change is added to this table, with the nature of the change (addition, replacement, removal) and the sub-processor concerned.
Earlier versions are retained so that the state of the list on a given date can be established. a completer : archiving arrangements and access to earlier versions, URL or request to hello@reponse.ai. On written request to hello@reponse.ai, we provide the version in force on a given date, within the limits of the archives we hold.
22. Service operator
Reponse (reponse.ai) is published and operated by Shmore, a French simplified joint-stock company (SAS) with share capital of 1,000 euros, registered office at 26 Thubert, 44118 La Chevrolière, France, registered with the Paris Trade and Companies Register under number 978 743 013.
a verifier : consistency between the registered office declared in Loire-Atlantique and the registration stated with the Paris Trade and Companies Register
a completer : intra-EU VAT number
a completer : name of the publication director
Host of the website and the application: Netlify, a completer : legal name, postal address and telephone number of the host.
The full legal notice is available at a completer : URL of the legal notice page.
This page is published in French and in English. In the event of any discrepancy between the two versions, a valider : binding version, French version proposed.