Sub-processor List
Last updated: 8 April 2026
Charter Companion engages the following sub-processors to deliver the AI-assisted guest communication service. All sub-processors are authorised under the Data Processing Agreement (DPA) between Charter Companion and each charter company (Controller).
Changes to this list are communicated to Controllers at least 30 days in advance, in accordance with § 10.2 of the DPA. Controllers may object to new sub-processors within that period.
Sub-processors Processing Charter Guest Personal Data
| Name | Purpose | Guest Data Shared | Region | Transfer Mechanism |
|---|---|---|---|---|
| Anthropic, Inc. | LLM inference (AI response generation) | Message content (last 10 messages in prompt context), guest phone number may appear in conversation | USA | SCCs + EU-US DPF |
| Meta Platforms Ireland Ltd. (WhatsApp Business API) | WhatsApp message delivery | Phone number (E.164) + message text (inbound and outbound) | EU / USA | Meta DPF |
| Supabase, Inc. | Database hosting + authentication | All application data (phone numbers, messages, sessions, escalations) | EU (Frankfurt) | Adequate — EU region (AWS eu-central-1) |
| Voyage AI, Inc. | Text embedding generation | Guest message text (query-time embedding) + document chunk text (ingestion) | USA | SCCs |
Sub-processors Processing Operator Data Only
These services process data about charter company staff (operators) only. No Charter Guest personal data is shared.
| Name | Purpose | Data Shared | Region | Transfer Mechanism |
|---|---|---|---|---|
| Supabase, Inc. | Authentication for portal users | Operator email address, hashed password | EU (Frankfurt) | Adequate — EU region |
| Fly.io, Inc. | Application runtime hosting | Transient runtime memory; masked logs only — no persistent guest PII | EU (Amsterdam) | Adequate — EU region |
| Functional Software, Inc. (Sentry) | Error monitoring | Exception traces (PII scrubbed before transmission) | USA | SCCs |
| Resend, Inc. | Transactional email | Operator email address, email subject and body | USA | SCCs |
| Stripe, Inc. | Billing and subscription management | Operator email, payment method metadata, billing address | USA | SCCs + EU-US DPF |
| PostHog, Inc. (EU Cloud) | Portal usage analytics | Page view events, click events; operator email and company name for identified sessions | EU | Adequate — EU cloud instance |
Third-party APIs — No Personal Data
The following services receive only non-personal data (search keywords, coordinates, place names). They are not sub-processors in the GDPR sense (Art. 4(8)) because no personal data is processed on behalf of the Controller. They are listed for transparency.
| Service | Purpose | Data Sent | Region |
|---|---|---|---|
| Tavily AI | Web search fallback | Location keywords from guest queries (no PII) | USA |
| Google LLC (Places API) | Place search | Location query strings (no PII) | USA |
| Open-Meteo | Weather data | Coordinates only (no PII) | EU (Switzerland) |
| Telnyx, Inc. | Phone number provisioning | Area codes, country codes (no PII) | USA |
| BetterStack, Inc. | Uptime monitoring | Monitoring metrics (no PII) | USA |
Change Notifications
In accordance with § 10.2 of the DPA, Charter Companion will notify Controllers at least 30 days in advance of any additions or replacements to this sub-processor list. Controllers may object to changes in writing within that period. If the parties cannot resolve the objection, either party may terminate the Service Agreement without penalty.
For questions about our sub-processors, contact [email protected].