List of sub-processors
Last updated: 23 September 2026 (version 1.0)
1. Purpose of this page
Reponse is a service published and operated by Shmore (see section 22). When you use Reponse, we process personal data on your behalf, whether that data relates to you or to your own customers: you act as the controller, we act as the processor within the meaning of Article 28 GDPR.
To deliver the service, we rely on technical providers that also process this data. These are sub-processors. This page lists them as at the date stated at the top. It is updated in accordance with the procedure set out in section 2.
This page serves three purposes:
- It constitutes the general written authorisation provided for in Article 28(2) GDPR: by accepting our data processing agreement (DPA), published at https://reponse.ai/legal/dpa, you authorise the use of the sub-processors listed here.
- It may be annexed as is to that data processing agreement. The binding version is the one published at this page's address on the date stated at the top.
- It allows you to track changes and, where relevant, to object to them following the procedure set out in section 2.
This page does not replace our privacy policy (https://reponse.ai/legal/privacy), which describes the processing for which we act as controller (account, billing, website). Nor does it replace our legal notice (https://reponse.ai/legal) or the terms of sale applicable to the service (https://reponse.ai/legal/cgv).
2. How you are informed of a change
We may add, replace or remove a sub-processor, for example for technical, security, cost or service continuity reasons.
Publication. The list in force is the one published on this page, with the last-updated date shown at the top and the matching entry added to the version log in section 21. We do not individually notify each customer of changes to this list: if you want to follow these changes, consult this page and the version log.
General authorisation. By using the service, you give the general authorisation provided for in Article 28(2) GDPR for the sub-processors listed on this page as at the date shown at the top, and for those added later under the same publication procedure.
3. How to read the tables
For each sub-processor, the tables state:
- Sub-processor: the provider's name. The legal name and city of the contracting entity are given below each table.
- Role in the service: the function it performs. We seek to limit the data sent to each sub-processor to what is necessary for that function.
- Data categories: the types of personal data that may be processed.
- Processing location: the country or region where data is hosted or processed.
- Transfers outside the EU: the legal mechanism applicable where data leaves the European Union. See section 6.
We distinguish two categories:
- standard sub-processors (section 4), which may be involved for any customer, on any plan, including the free plan. Some of them are however involved only if the corresponding feature is used: for example the artificial intelligence model providers when an AI feature is used, or Stripe only for workspaces still billed through Stripe (section 4.3);
- customer-activated sub-processors (section 5), involved only if you activate the corresponding integration yourself from your workspace.
4. Standard sub-processors
4.1 Hosting and infrastructure
| Sub-processor | Role in the service | Data categories | Processing location | Transfers outside the EU |
|---|---|---|---|---|
| Supabase | Primary database, user authentication, file storage, backups | Account and authentication data (name, email, technical identifiers), conversation and ticket content, CRM contact records, customer reviews, loyalty and referral data, catalogue and orders, attachments, technical logs | Ireland (EU), AWS eu-west-1 | Not applicable: hosting within the European Union |
| Netlify | Hosting of the website, the application and the server functions | Data transiting through requests (form and API call content), IP addresses, request headers, technical logs | United States (Netlify, Inc.), delivered via a global content delivery network | See section 6 |
Contracting entities:
- Supabase: Supabase, Inc. (United States)
- Netlify: Netlify, Inc., San Francisco (California, United States)
4.2 Artificial intelligence models
The service uses the paid API offerings of three model providers. Each task (classification, extraction, drafting, agent replies, image analysis) is assigned to a model tier, and each tier to a specific model. As at the date this page was last updated, all generation requests and the computation of the vector representations (embeddings) used to search the knowledge base are sent to OpenAI. Google and Mistral are integrated into the service and may receive some or all requests when a task is assigned to them; such a change will be recorded in the version log. See section 10 for details on this processing.
| Sub-processor | Role in the service | Data categories | Processing location | Transfers outside the EU |
|---|---|---|---|---|
| OpenAI | Generation of AI agent replies, classification, extraction and assisted drafting, computation of embeddings for the knowledge base and the catalogue, extraction of lasting preferences of an identified contact (stored in their CRM record) | Content of messages submitted to the agent, excerpts of the knowledge base, catalogue and orders used as context, instructions configured by the merchant, text to be indexed | United States | See section 6 |
| Generation of AI agent replies and other AI tasks, when a task is assigned to a Gemini model | Same categories as above | United States | See section 6 | |
| Mistral | Generation of AI agent replies and other AI tasks, when a task is assigned to a Mistral model | Same categories as above | European Union | Not applicable: processing within the European Union |
Contracting entities:
- OpenAI: OpenAI Ireland Limited, Dublin (Ireland), with processing by OpenAI, L.L.C., San Francisco (United States)
- Google: Google Ireland Limited, Dublin (Ireland), or Google LLC, Mountain View (United States), depending on the terms applicable to the Gemini API
- Mistral: Mistral AI SAS, Paris (France)
4.3 Payments
Reponse is billed through Shopify (Shopify App Pricing). Stripe is now involved only in the two cases below.
| Sub-processor | Role in the service | Data categories | Processing location | Transfers outside the EU |
|---|---|---|---|---|
| Stripe | Billing of the legacy Reponse Core subscription, which is no longer sold, only for workspaces that took it out through Stripe and still hold it | Subscriber identity and contact details, billing address, payment method data, transaction history | Ireland (EU) — Stripe Payments Europe Ltd, with transfers to Stripe, Inc. (United States) | See section 6 |
| Stripe | Collection of payments for orders placed with the merchant, on the merchant's own connected Stripe account, where the merchant activates and uses this feature | Buyer identity and contact details, order amount and details, payment data | Ireland (EU) — Stripe Payments Europe Ltd, with transfers to Stripe, Inc. (United States) | See section 6 |
Contracting entity: Stripe Payments Europe Limited, Dublin (Ireland).
Scope: the first row concerns only workspaces still billed through Stripe. The second row relates to a feature activated by the merchant and is therefore subject to the regime described in section 5.
Card data is entered on the payment page hosted by Stripe or in its embedded payment form, and does not transit through our servers.
Note: for the payment data it collects and retains on its own account, in particular under its regulatory anti-fraud and anti-money-laundering obligations, Stripe may act as an independent controller and not as our sub-processor.
4.4 Email
| Sub-processor | Role in the service | Data categories | Processing location | Transfers outside the EU |
|---|---|---|---|---|
| Resend | Main sending provider: transactional emails and outbound emails from the service; return of delivery events | Sender and recipient email addresses, subject and body of the message, attachments where applicable, deliverability metadata (sent, delivered, bounced, complained) and, where open and click tracking is enabled on the sending domain, date of first open and first click | United States | See section 6 |
| Amazon SES | Backup sending provider: used only when we switch sending to it, for example if Resend is unavailable | Same categories as above, excluding delivery events | AWS region selected at configuration | See section 6 |
Contracting entities:
- Resend: Plus Five Five, Inc. (United States), which operates Resend
- Amazon SES: Amazon Web Services EMEA SARL, Luxembourg, with possible transfers to Amazon Web Services, Inc. (United States)
Delivery events are sent back to us by Resend as webhooks signed under the Svix signature scheme. We verify that signature ourselves, without calling or sending any data to Svix: Svix is therefore not our sub-processor.
4.5 Product analytics
| Sub-processor | Role in the service | Data categories | Processing location | Transfers outside the EU |
|---|---|---|---|---|
| PostHog | Audience measurement and analysis of product and website usage | Technical identifier assigned to the visitor or user, usage events (page views, actions in the interface), browser and device information, connection IP address; server side, technical events of the service (for example the processing of a widget message, linked to the conversation session identifier and the workspace, without the message content) | Germany (EU), Frankfurt — European instance (eu.i.posthog.com) | Not applicable: processing within the European Union |
Contracting entity: PostHog, Inc. (United States).
In the browser, analytics is subject to the consent banner: no event is sent to PostHog until you have accepted. Your choice is stored in your browser under the cookie_consent key, together with its date (cookie_consent_at) and the banner version (cookie_consent_version); it is valid for six months, after which the banner is shown again. It can be changed at any time. Technical events sent by our servers do not depend on this banner. Details are set out in the cookie policy (https://reponse.ai/legal/cookies).
4.6 Product page enrichment
| Sub-processor | Role in the service | Data categories | Processing location | Transfers outside the EU |
|---|---|---|---|---|
| Jina AI | Extraction of the content of public product pages to enrich catalogue product sheets | Public URL of the product page; no customer personal data is intended to be transmitted | Germany and United States | See section 6 |
Contracting entity: Jina AI GmbH, Berlin (Germany).
5. Sub-processors activated only at your request
The providers below are involved only if you activate the corresponding integration from your workspace (for Shopify: by installing the Reponse app on your store). Activation constitutes your instruction to transmit the data concerned, and that data is sent to them only as part of the activated integration.
| Sub-processor | Role in the service | Data categories | Processing location | Transfers outside the EU |
|---|---|---|---|---|
| Shopify | Store synchronisation: catalogue, orders, customers, commerce events | Identity and contact details of store customers, shipping and billing addresses, order content and status, catalogue data | Canada, with processing also taking place in the United States | European Commission adequacy decision for Canada. See section 6 for processing in the United States |
| Klaviyo | Synchronisation of contacts and events towards your marketing campaigns | Contact identity and details, email addresses, usage and order events transmitted | United States | See section 6 |
| Notion | Content synchronisation, in particular knowledge base and pages used by the service | Content of synchronised pages, which may contain personal data depending on what you place there | United States | See section 6 |
| TikTok Shop | Synchronisation of orders and messages from the TikTok Shop store | Buyer identity and contact details, order content and status, messages exchanged | Outside the European Union | See section 6 |
| Stripe | Collection of payments for orders placed with the merchant, where this feature is activated (see section 4.3) | Buyer identity and contact details, order amount and details, payment data | Ireland (EU) — Stripe Payments Europe Ltd, with transfers to Stripe, Inc. (United States) | See section 6 |
| Meta Platforms Ireland Ltd | Connection to the WhatsApp Business Platform or to Messenger, when you activate this integration | Sender identity (phone number or profile id), message content | Ireland (EU), with transfers to Meta Platforms, Inc. (United States) | See section 6 |
Contracting entities:
- Shopify: Shopify International Limited, Dublin (Ireland), with Shopify Inc., Ottawa (Canada)
- Klaviyo: Klaviyo, Inc., Boston (United States)
- Notion: Notion Labs, Inc., San Francisco (United States)
- TikTok Shop: TikTok
- Meta Platforms Ireland Ltd: Meta Platforms Ireland Limited, Dublin (Ireland)
When you activate an integration, the provider concerned may also act as a controller for its own purposes, under the contractual relationship you hold directly with it. That relationship falls outside our data processing agreement.
6. Transfers outside the European Union
Some of the sub-processors listed above process data outside the European Union, in particular in the United States and, for Shopify, in Canada.
Transfers to the United States rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses (implementing decision 2021/914) included in the provider's data processing terms. For Canada, the transfer relies on the adequacy decision adopted by the European Commission.
We claim no certification and no compliance label. We do not guarantee that data remains at all times within the European Union, unless expressly stated in the tables above.
On written request to hello@reponse.ai, we share with the customer the information we hold on the transfer mechanism applicable to a given sub-processor.
7. Location of data at rest and in transit
This section is distinct from the transfer mechanism addressed in section 6: it concerns where the data is physically held.
- Data at rest (primary database, files, backups): hosted with Supabase, AWS eu-west-1 region (Ireland, EU). Backups are kept in the same region.
- Data in transit: exchanges between the browser, our application and our sub-processors are encrypted (TLS).
- Temporary copies: public pages and responses may be cached by Netlify's content delivery network, and emails being sent pass through the email provider's queues, for as long as they are being processed.
We do not state that all processing is located within the European Union: the sub-processors that process data outside the Union are flagged in the tables in sections 4 and 5.
8. Obligations imposed on our sub-processors
In accordance with Article 28(4) GDPR, our rule is to ensure that each sub-processor is subject to data protection obligations substantially equivalent to those binding us to you, in particular:
- processing data only on documented instructions and for the intended purpose;
- ensuring the confidentiality of persons authorised to access the data;
- implementing appropriate technical and organisational measures;
- assisting us with data subject requests and personal data breaches;
- deleting or returning data at the end of the engagement.
Where these obligations arise from the provider's standard terms rather than from a negotiated agreement, it is that standard document that applies.
We remain liable to you for the performance of our sub-processors' obligations, within the limits set out in the contract entered into with you.
9. Security measures
We claim no certification, no external audit and no security label.
The technical and organisational measures implemented under Article 32 GDPR are as follows:
- access to data: only Shmore's director, Vincent Redor, accesses customer data, from France, and only where necessary to operate the service or where the customer asks for it as part of a support request;
- encryption: data is encrypted in transit (TLS) and at rest (Supabase);
- segregation: each workspace's data is segregated at database level (Row Level Security);
- authentication: two-factor authentication is enabled on the administration accounts of the operating tools (Supabase, Netlify, GitHub, Shopify Partner);
- backups: daily database backups by Supabase, kept for 7 days in the same region (eu-west-1, Ireland);
- personal data breaches: the customer is informed as set out in section 13.
We undertake to state, in response to a security question, only measures that are actually implemented and verifiable.
10. Processing by artificial intelligence models
When an AI feature is used, the content of conversations and the necessary context (knowledge base, catalogue and order excerpts, merchant instructions) is transmitted to the model provider to which the task is assigned (see section 4.2) in order to produce the reply.
We do not train models on our customers' data. We use the paid API offerings of OpenAI, Google (Gemini) and Mistral, under which the transmitted data is not used to train the models, according to each provider's terms. Requests and responses may be retained by the provider for up to 30 days. We are not in a position to guarantee the behaviour of each provider beyond its own contractual undertakings.
We recommend not submitting to the agent any special category data within the meaning of Article 9 GDPR.
11. Retention periods applicable to the service and passed on to our sub-processors
The periods below are those applicable to the service. Each provider's own logs and temporary copies are also subject to that provider's terms.
- account: term of the contract, then 30 days;
- conversations, CRM records and tickets: 3 years after the last contact with the data subject, and no later than the deletion provided for at the end of the contract (section 15);
- technical logs: 12 months;
- billing data and accounting records: 10 years.
Backups and disaster recovery copies. Data deleted from the live database may temporarily remain in backups. Backups are taken daily, kept for 7 days in the eu-west-1 region (Ireland), and erased as they rotate: deleted data disappears from them no later than 30 days after its deletion.
12. Audit and documentation, Article 28(3)(h) GDPR
On written request to hello@reponse.ai, we make available the information we hold to demonstrate compliance with our Article 28 obligations, in particular this list, the security measures described in section 9 and the transfer mechanism information referred to in section 6.
Audit arrangements: an audit first takes the form of a written questionnaire, no more than once a year. An inspection takes place only if the answers to the questionnaire are insufficient; it is announced with 30 days' notice, is carried out at the customer's expense, and the auditor is bound by confidentiality. We do not publish a transparency report.
13. Personal data breaches, Articles 28(3)(f) and 33 GDPR
In the event of a breach affecting personal data processed on your behalf, we undertake to inform you without undue delay after becoming aware of it, so that you can meet your own notification obligations.
- Notification deadline: no later than 72 hours after becoming aware of it.
- Channel: email to the workspace administrators' address.
- Content: nature of the breach, categories and approximate volume of data and data subjects concerned, likely consequences, measures taken or envisaged, point of contact.
As the controller, it is for you to decide whether to notify the supervisory authority and, where applicable, the data subjects.
The point of contact for any question about a breach is hello@reponse.ai, with the subject "Data protection".
14. Assistance with data subject rights, Article 28(3)(e) GDPR
Requests for access, rectification, erasure, restriction, objection and portability relating to data we process on your behalf must be addressed to you: you are the controller.
If we receive such a request directly in relation to data processed on your behalf, we do not answer it on the merits ourselves. We forward it to the administrator of the workspace concerned and inform the requesting individual.
We assist you, as far as possible and taking into account the nature of the processing, through the features available in the product and, where necessary, through manual handling on request to hello@reponse.ai (for example an export of a person's data or its deletion). This assistance is free of charge in ordinary cases; beyond that, it is subject to a prior quote.
15. End of the contract and fate of the data, Article 28(3)(g) GDPR
At the end of the contract:
- return: on written request to hello@reponse.ai, we provide an export of your data in CSV or JSON format, within 30 days of the request;
- deletion: the data is deleted 30 days after the end of the contract, subject to the backups referred to in section 11, which are erased as they rotate and no later than 30 days afterwards, and to data we are required to retain under a legal obligation, in particular accounting rules.
If you wish to retrieve your data, make your export request before that 30-day period expires.
16. End data subjects, the merchants' own customers
If you are an end customer of a store using Reponse and wish to exercise your rights over your data, contact the merchant you ordered from or exchanged messages with. That merchant is the controller. We act only on its instructions and cannot, on our own initiative, modify or delete its data.
If you write to us directly at hello@reponse.ai, we forward your request to the merchant concerned and inform you accordingly, without handling the request on the merits.
17. Reponse staff, affiliates and support providers
Only Shmore's director, Vincent Redor, accesses data processed on your behalf, from France, for the operation, support and maintenance of the service. He is bound by confidentiality. He accesses your workspace for support only at your request.
Shmore has no subsidiary or affiliate accessing the data.
Shmore has no employee, outsourced support provider, development contractor or freelancer accessing the data. Should any such party come to exist, it would be added to this page under the procedure in section 2.
18. Complaints and supervisory authority
You may lodge a complaint with the French data protection authority, Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.
19. Contact
For any question about this list, or to request a copy of the documentation relating to a sub-processor:
- general email: hello@reponse.ai
- support: support@reponse.ai
- data protection point of contact: hello@reponse.ai, with the subject "Data protection"
- data protection officer: none has been appointed; the point of contact above is the single point of contact
- postal address: Shmore, 26 Thubert, 44118 La Chevrolière, France
20. Governing law and jurisdiction
This page and the contractual annex it constitutes are governed by French law, like the main contract.
Jurisdiction: the competent courts of Nantes, France, as provided in the terms of sale.
21. Version log and access to earlier versions
| Version | Date | Change |
|---|---|---|
| 1.0 | 23/09/2026 | Publication of the list in force |
Any later change is added to this table, with the nature of the change (addition, replacement, removal) and the sub-processor concerned.
Earlier versions are retained so that the state of the list on a given date can be established. On written request to hello@reponse.ai, we provide the version in force on a given date, within the limits of the archives we hold.
22. Service operator
Reponse (reponse.ai) is published and operated by Shmore, a French simplified joint-stock company (SAS) with share capital of 1,000 euros, registered office at 26 Thubert, 44118 La Chevrolière, France, registered with the Nantes Trade and Companies Register under number 990 895 971.
EU VAT number: FR26990895971
Publication director: Vincent Redor
Host of the website and the application: Netlify, Inc., San Francisco (California, United States).
The full legal notice is available at https://reponse.ai/legal.
This page is published in French and in English. In the event of any discrepancy between the two versions, the French version prevails.