UiChemy Legal & Compliance
Sub-processors
Last updated:
The table below lost its header row in the source — column names taken from the other tables in this document. It also has no section heading of its own.
| Provider | Purpose | Region | Notes |
|---|---|---|---|
| OpenAI | Text/content generation | US | API data not used for training by default; ~30-day abuse-monitoring retention [B] |
| Anthropic | Text/content generation | US | Commercial/API data excluded from training; ~30-day retention [B] |
| Google (AI) | Text/content generation | US | Paid API / Vertex: prompts not used to improve products [B] |
| Groq | Inference | US | — terms not checked |
| Recraft | Image generation | — terms not checked |
2.2 Infrastructure and storage
| Provider | Purpose | Region | Notes |
|---|---|---|---|
| Hetzner | Primary hosting | EU (Germany) | Genuine strength — say so |
| Cloudflare R2 | Generated image storage | ||
| Cloudflare | CDN, DNS, Turnstile | Global | IP addresses transit |
| BunnyCDN | Asset CDN | Global |
2.3 Product and operations
| Provider | Purpose | Data received | Notes |
|---|---|---|---|
| Trigger.dev | Background jobs | Prompt content in its run store | Not just telemetry — a job store containing user prompts. reconcile-create-gaps depends on this persistence |
| Sentry (sentry.io, EU region) | Error monitoring | Errors; potentially unscrubbed prompts | Cloud, hosted in Sentry's EU data region — data stays in the EU. Disclose openly. See note below |
| PostHog | Product analytics | Behavioural events, plus email and name | EU cloud for the plugin. the web app instance region |
| Gleap | In-app support | Support conversations, user identity | |
| Microlink | URL screenshots for site-capture | Target URLs | WP plugin. Currently undisclosed in the readme |
| Google (Apps Script / Sheets) | Feedback capture | Name, email, feedback text | Figma plugin |
| FirstPromoter | Affiliate tracking and payouts | Affiliate account data, conversion data |
2.4 Third-party recipients — remove rather than disclose
Not strictly sub-processors, but they receive visitor data and must be disclosed or eliminated. Both are cheap to eliminate, and elimination is the better answer.
| Recipient | What it receives | Recommendation |
|---|---|---|
| Google Fonts | IP, user agent, referrer, on every load | Self-host. Removes the issue entirely. Appears in the Figma plugin, the WP plugin and the website — fix once, fix everywhere |
| Automattic (Gravatar) | MD5(email), IP, user agent | Drop or serve avatars yourself. MD5 of an email is pseudonymisation, not anonymisation |
3. Independent controllers — NOT sub-processors
| Party | Role | Why it is not a sub-processor |
|---|---|---|
| Paddle | Merchant of Record | Paddle and POSIMYTH are independent controllers under a Data Sharing Addendum. [A] The buyer contracts with Paddle, which collects payment data directly for its own purposes. Disclose prominently in the Privacy Policy with a link to Paddle's policy — but never list Paddle as a sub-processor. Enterprise reviewers check this |
| The customer's own AI provider (UiChemy Pro) | Customer's controller/processor | Pro's AI chat uses the site admin's own provider and key via WordPress 7.0's AI Client. The key never touches POSIMYTH and nothing is stored on our servers. We are not in that data path at all |
Add to the Privacy Policy: *we never see or store card data* — verified true in the web app audit. It is a real security statement, not marketing.
4. Self-hosted — no third party involved
Run on POSIMYTH-controlled infrastructure. No data leaves to a third party. Listed for transparency only.
| System | Purpose | Host |
|---|---|---|
| Plausible Analytics | Website analytics | analytics.posimyth.com — cookieless, first-party |
| FluentCRM | Email marketing | store.posimyth.com |
| Fluent Support | Support desk | store.posimyth.com |
| BugSink | Error monitoring (Figma plugin) | bugs.uichemy.com — Sentry-compatible |
| MongoDB | Primary database | Self-hosted on own VPS — confirmed 2026-08-20 |
| Easy Digital Downloads / WooCommerce | Legacy commerce | Own sites |
5. International transfers
POSIMYTH INC is a US (Delaware) entity with no EU establishment. All staff operate from India. Primary hosting is EU-region (Hetzner).
| Flow | Mechanism |
|---|---|
| EU/UK → POSIMYTH INC (US) | EU-US Data Privacy Framework self-certification, with 2021 SCCs as fallback (DPF appeal C-703/25 P is pending) |
| POSIMYTH INC (US) → India (staff access) | Intra-group transfer agreement + SCCs + supplementary measures |
| EU/UK → POSIMYTH Innovations (India), legacy customers | 2021 SCCs + UK Addendum + documented TIA |
| POSIMYTH → US sub-processors | Provider's own SCCs / DPF certification — verify per provider |
Be accurate about EU hosting. It genuinely reduces risk and is worth stating — but staff access from India is a transfer regardless of where the disk sits. Any knowledgeable reader will spot a claim that implies otherwise.
6. Change notification
7. Open items before publishing
| # | Item |
|---|---|
| 1 | Provider retention/training confirmations for all five AI providers, at your tier |
| 2 | MongoDB — Atlas (§2) or self-hosted (§4)? |
| 3 | Sentry — sentry.io (§2) or self-hosted BugSink (§4)? |
| 4 | Region for Recraft, Cloudflare R2, and the web app's PostHog instance |
| 5 | Set up the subscription mechanism for §6 |
| 6 | Confirm the notice period is identical in the DPA |
| 7 | Decide on Google Fonts and Gravatar — eliminating both is cheaper than disclosing them |
| 8 | Add Microlink to the WP plugin readme's External Services block |
POSIMYTH INC 251 Little Falls Drive, Wilmington, New Castle County, Delaware 19808, USA [email protected]