Legal documents
Sub-Processors
Contents
About This Register
When you use the Aopy platform to store your contacts and send them email or SMS messages, you act as the data controller of that Contact Data, and Easy Life Tech SRL ("Aopy", "we", "us") acts as your data processor, as set out in our Data Processing Agreement (the "DPA").
A sub-processor is a third-party service provider that Aopy engages to process personal data on behalf of our customers in order to deliver the Service — for example, cloud infrastructure, email delivery or error monitoring. Under Article 28(2) and 28(4) GDPR, we may use sub-processors only with your authorisation and under a written contract that imposes data-protection obligations equivalent to those we owe you.
This page is the canonical register of the sub-processors we use. Under the DPA, customers grant a general written authorisation for the sub-processors listed here. We give advance notice of intended additions or replacements, and you may object through the mechanism described in the DPA.
Sub-Processor Register
The table below lists each sub-processor, the purpose for which we engage it, the categories of personal data it processes, its processing location and the transfer safeguard that applies.
| Sub-processor | Purpose | Personal data processed | Location / region | Transfer safeguard |
|---|---|---|---|---|
| Amazon Web Services | Email delivery and message-queue infrastructure | Contact email addresses, message content, engagement events | EU (Ireland); backup email region EU (Frankfurt) | Processing within the EEA |
| Supabase | Database and authentication | All platform data | EU (Ireland) | Processing within the EEA |
| Vercel Inc. | Application hosting and CDN | Platform data in transit through the application layer, plus request metadata, IP addresses and user-agent | EU edge + US control plane | SCCs |
| Stripe | Payments and subscriptions | Billing identity and payment references (we store only Stripe reference identifiers and masked card details — brand and last four digits; we never store card numbers) | EU / USA | SCCs |
| Upstash | Rate limiting and background job queueing | Transient request keys; queued job payloads for creative generation, which carry storage paths, generation prompts and organisation identifiers | EU (Ireland) | Processing within the EEA |
| SmartBill (Intelligent IT SRL) | Issuing your invoices — SmartBill is our invoice issuer of record | Billing identity: company name, fiscal identification code (CUI), registered address and billing contact details | Romania (EU) | Processing within the EEA |
| Google Fonts (Google Ireland Limited / Google LLC) | Web-font delivery for the sign-up popup we render on customers' storefronts and for the fonts used in campaign emails | The IP address and browser user-agent of the storefront visitor or email recipient whose browser or email client requests the font file | EU + USA | SCCs and the EU-US Data Privacy Framework |
| Easy Life Tech SRL — internal CRM | Following up on enquiries submitted through Aopy's own public marketing forms (see note below) | Name, email address, phone number, company website and questionnaire answers of people who complete a form on aopy.com | Easy Life Tech SRL (internal system), EU | Internal — same controller, no transfer outside the EEA |
| Sentry | Error monitoring and session diagnostics | Error traces and partial request metadata; privacy-masked session replays of the Aopy application interface, recorded only when an error occurs (all text and media are masked; request and response bodies are not recorded); and any screenshot you choose to attach to a feedback report | USA | SCCs |
| SMSO.ro | SMS delivery (Romania) | Phone numbers, SMS message content, delivery receipts | Romania (EU) | Processing within the EEA |
| OpenAI | AI generation features — image generation, analysis of an uploaded brand guide, and marketing-copy drafting — and the in-app support assistant, which drafts a first answer to a support message you send us (optional; all of them disabled when your organisation's US-AI processing setting is off). Separately, and only when a user connects it, the Aopy connector for ChatGPT, also disabled when that setting is off (see the Anthropic row below) | Generation prompts, product images and brand assets you upload; and, for the support assistant, the text of the support message you write together with configuration facts about your own workspace — sending domain and its DNS status, SMS credit balance, active modules with their price, billing interval and trial state, which billing rail charges you, onboarding step and account-health warnings — no Contact Data, no campaign or message content, and nothing about your own customers or their orders. For the ChatGPT connector: the results of what the user asks Aopy for in that chat, with contact email addresses and phone numbers masked (see the Anthropic row below) | USA | SCCs |
| Anthropic (Claude) | The optional Aopy connector for Claude — only when a user connects their own Claude account to Aopy; data flows only on that user's requests in the chat (disabled when your organisation's US-AI processing setting is off) | The results of what the user asks Aopy for in that chat — for example campaign, segment, revenue, order and product figures, and contacts with email addresses and phone numbers masked (an owner or admin can ask for one contact's full email address). Nothing is sent unprompted, and the user's Aopy password never reaches Anthropic | USA | SCCs |
| remove.bg (Canva Austria GmbH) | Image background removal (optional feature; disabled when your organisation's US-AI processing setting is off) | Uploaded images | Austria (EU); the provider states it may also process at facilities its affiliates or service providers maintain in other countries | Processing within the EEA by the contracting entity; an adequacy decision or Standard Contractual Clauses for any onward transfer, per the provider's published privacy policy |
| ANAF e-Factura | Mandatory Romanian electronic invoicing (when billing is active) | Invoice and fiscal data | Romania (state authority) | Legal obligation — independent public-authority recipient (see note below) |
| Meta, TikTok, Google Ads/GA4, Shopify, WooCommerce | Optional integrations that you connect; data flows only on your instruction | Advertising audiences, product and order data; and, for the ad platforms' conversion APIs, hashed identifiers of the buyer (email address, phone number, name and address, hashed with SHA-256) together with the buyer's unhashed IP address and browser user-agent, which those APIs require in that form — depending on the integration | Per provider | Customer-directed transfers (see "Customer-Directed Integrations" below) |
Note on the internal CRM: Easy Life Tech SRL operates its own EU-hosted CRM system and writes the enquiries submitted through Aopy's public marketing forms into it. Because it is a system of the same legal entity, it is not a sub-processor within the meaning of Article 28 GDPR and its use is not subject to the objection mechanism. It is listed here, and named as a recipient in our Privacy Policy, for transparency. It never receives Contact Data that customers hold on the platform.
Note on ANAF: ANAF (the Romanian tax authority) receives invoice data because Romanian law obliges us to transmit it. Strictly speaking, ANAF acts as an independent recipient — a public authority — rather than a sub-processor within the meaning of Article 28 GDPR. It is listed here for transparency, and this transmission is not subject to the objection mechanism.
International Transfers
Our primary infrastructure is located in the European Union (AWS and Supabase in Ireland). Where a sub-processor processes personal data in the United States or otherwise outside the European Economic Area, the transfer is safeguarded by the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) or another valid transfer mechanism under Chapter V GDPR.
Control over US AI processing. The AI features are optional: image generation, analysis of an uploaded brand guide, marketing-copy drafting, image background removal, and the in-app support assistant. An organisation-level setting lets each customer disable all of them; when that setting is off, no data is sent to any of these providers for any of these features — a support message then goes straight to a person on our team, as it did before. What is transmitted is the prompt, product image or brand asset supplied for the feature, or — for the support assistant — the support message you wrote and configuration facts about your own workspace. Never Contact Data. The same setting also disables the Claude and ChatGPT connector described below.
Claude and ChatGPT connector. If a user connects Aopy to Claude (Anthropic) or ChatGPT (OpenAI), the results of what that user asks for in the chat are sent to that provider in the United States, on the user's instruction and under the provider's own terms for the user's account. It works only after a user signs in with their Aopy account, approves it and chooses the organisation, and access can be revoked at any time in the Aopy app. The organisation-level setting described above also disables it: while that setting is off, no one can connect Claude or ChatGPT to the organisation and Aopy refuses every request from a connection already made. Contact email addresses and phone numbers are masked by default. See our Privacy Policy.
Web fonts. The sign-up popup we render on customers' storefronts, and the templates used for campaign emails, load their typefaces from Google's font service. Requesting a font file discloses the storefront visitor's or email recipient's IP address and browser user-agent to Google. Nothing else is sent: the request carries no Aopy cookie and no Contact Data.
To request a copy of the transfer safeguard applicable to a specific sub-processor, contact privacy@aopy.com.
Customer-Directed Integrations
The Service offers optional integrations with Meta, TikTok, Google Ads/GA4, Shopify and WooCommerce. These providers are not sub-processors engaged at our initiative: personal data flows to or from them only when you, the Customer, connect and configure the relevant integration. Those flows take place on your documented instruction, and each provider processes the data under its own terms.
The data involved depends on the integration — for example, advertising audiences for ad platforms, and product or order data for e-commerce platforms. Before connecting an integration, you should satisfy yourself that you have a lawful basis for the resulting transfer and review the provider's own privacy documentation. Practical guidance is available in our Data Processing Guidelines.
Separately from the customer-directed integrations above, Aopy uses Google Analytics, the Meta Pixel and the TikTok Pixel on its own public marketing website (aopy.com) for its own analytics and advertising, as an independent controller of site-visitor data. This does not involve Customer platform data and is not sub-processing under this register; see our Cookie Policy for details.
Changes to This Register
This page is the authoritative, current version of our sub-processor register. Each revision updates the "Last updated" date shown on this page.
Before we add or replace a sub-processor that will process personal data on your behalf, we will give you advance notice in accordance with the DPA, so that you can object within the window stated there. To receive change notifications by email, write to privacy@aopy.com with the subject line "Sub-processor notifications".
Contact
Questions about this register or our sub-processing arrangements can be addressed to our Privacy Team at privacy@aopy.com.
Easy Life Tech SRL, CUI 54742254, Trade Register No. J2026033503008, registered office: Șos. București-Ploiești, Nr. 15, Imobilul 2 - Spațiu Comercial, Etaj 5, Sector 1, București, Romania. See also our Privacy Policy and Data Processing Agreement.
Language
This register is published in English and Romanian. In the event of any inconsistency between the two versions, the English version prevails.