Sub-Processors
Version 4.3 · Effective 3 July 2026 · Last updated 15 October 2026
This document is published in English only, as it is in the Wevion app (app.wevion.ai/sub-processors), where you accept it.
In brief
Wevion is operated by Bhblasted SRL SB. To run the platform we rely on third-party providers ("sub-processors") that may process personal data on our behalf under Article 28 GDPR. This page is the current, factual list. Where a cell shows a dash (—), we have not yet confirmed that detail. Some providers only receive data once you connect your own ad-platform account or turn on server-side tracking. A few providers are outside the EU, including three based in China (DeepSeek, Moonshot/Kimi, TikTok) and analytics hosted in the US (PostHog, Microsoft Clarity) — these carry higher transfer risk and are called out explicitly. You can object to any change to this list; we notify you before adding or replacing a sub-processor.
- Controller: Bhblasted SRL SB (Italy).
- Every provider we have identified is listed below, grouped by category.
- High-risk non-EU transfers (China + US hosts) are flagged separately.
- Some providers are 'active', others 'activatable' (gated off).
- You have a right to object; we give advance notice of changes.
Changes in version 4.3
Version 4.3 (15 October 2026) lists, for the first time or for a new purpose, providers that were already in use before that date: fal.ai, Tavily, Creatomate, Photoroom, ExoClick, Klaviyo, Slack, Telegram (support chats), Anthropic (drafting replies to support chats), Google Tag Manager, the Meta, TikTok, X and OpenAI Ads pixels, and the Meta, TikTok and X server-side conversion APIs. If you are a customer and object to any of them on reasonable data-protection grounds, write to privacy@wevion.ai within 30 days of this date; section 7.3 of the Data Processing Agreement applies.
What sub-processors are and our Article 28 relationship
A sub-processor is a third party that Bhblasted SRL SB (as processor, or where applicable controller) engages to process personal data in order to deliver the Wevion service — for example cloud hosting, AI generation, analytics, payments or notifications.
By using Wevion you give us a general written authorisation (Article 28(2) GDPR) to engage the sub-processors listed on this page and to add or replace sub-processors from time to time. When we intend to add a new sub-processor or replace an existing one, we will notify you in advance and give you the opportunity to object on reasonable data-protection grounds before the change takes effect (see 'How we notify changes and your right to object').
We impose data-protection obligations on every sub-processor that are no less protective than those in our agreement with you, and we remain responsible to you for their performance.
- General authorisation: you authorise the sub-processors listed here.
- Advance notice: we tell you before adding or replacing one.
- Right to object: you may object on data-protection grounds.
- Flow-down: sub-processors are bound by Article 28-level terms.
Sub-processors — Infrastructure & core platform
| Provider | Purpose | Data categories | Location/Region | Transfer mechanism |
|---|---|---|---|---|
| Amazon Web Services (AWS): Aurora PostgreSQL, ElastiCache, S3, SQS, SES | Main database, cache, object storage, message queues and transactional email (core hosting) | Account data, uploaded files/creatives, campaign data, AI chat history, email address and message content, operational metadata | EU (eu-west-1, Ireland) | Intra-EU |
| Stripe | Payments, subscriptions and billing | Billing identity, payment metadata, subscription data | US | — |
| Sentry | Error monitoring and diagnostics | Technical/error data, user/session identifiers, request metadata | US (ingest.us.sentry.io) | — |
Sub-processors — AI / LLM & creative generation
Which AI provider actually processes a given prompt depends on runtime model routing/configuration. In production the default model is DeepSeek (deepseek-chat). All of the following are wired and are therefore sub-processors.
| Provider | Purpose | Data categories | Location/Region | Transfer mechanism |
|---|---|---|---|---|
| DeepSeek | LLM chat/generation (default model in production) | User prompts and content, generated output | China | SCC + supplementary measures + TIA (not yet confirmed) — high risk |
| Moonshot / Kimi | Long-context LLM | User prompts and content, generated output | China | SCC + supplementary measures + TIA (not yet confirmed) — high risk |
| Anthropic (Claude) | LLM chat/generation; drafting replies to customer support chats | User prompts and content, generated output, support chat messages | US | — |
| Google (Gemini) | LLM generation | User prompts and content, generated output | US | — |
| OpenAI | LLM chat (Expert mode), image generation, TTS, transcription | User prompts and content, images, audio, generated output | US | — |
| Black Forest Labs (Flux) | AI image generation | Prompts, generated images | EU (not yet confirmed) | — |
| Runway | AI video generation | Prompts, generated media | US | — |
| HeyGen | AI avatar/video generation | Prompts, generated media | US | — |
| ElevenLabs | AI voice / TTS | Text, generated audio | US | — |
| Higgsfield | AI generation | Prompts, generated media | — | — |
| fal.ai | AI video generation (Kling, Veo and Luma models) | Prompts, reference images, generated video | — | — |
| Tavily | Web search for the AI assistant | Search queries the assistant writes from your requests | — | — |
| Creatomate | Video composition (templates, text and media assembled into a video) | Templates, text and media of your creatives | — | — |
| Photoroom | Background removal from images | Images you submit | — | — |
Sub-processors — Analytics & advertising measurement (our app and website)
These providers receive data for which Bhblasted SRL SB is the controller. They are listed here for transparency: for this processing they are recipients, and in part controllers or joint controllers, rather than sub-processors of Customer data under the Data Processing Agreement. These are the tags, and the conversion data sent by our servers, that we use to measure our own product and advertising. They receive data about visitors and users of Wevion whether or not you connect an ad account.
| Provider | Purpose | Data categories | Location/Region | Transfer mechanism |
|---|---|---|---|---|
| PostHog | Product analytics / event tracking, in the app and on wevion.ai | Usage events, user/session identifiers, device metadata | US (default host us.i.posthog.com) | — (US host, high risk) |
| Microsoft Clarity | Session analytics / behaviour, in the app and on wevion.ai | Session recordings/behavioural events, non-PII identifiers | US | — |
| Google Analytics 4 / Google Ads (measurement) / Google Tag Manager | Web/product analytics and ad measurement, in the app and on wevion.ai; Tag Manager loads Google's tags on wevion.ai | Usage events, identifiers, conversion data | US | — |
| Meta (Meta Pixel, Conversions API) | Advertising measurement: the pixel in the app and on wevion.ai, and conversions sent by our servers | Page visits, browser identifiers, conversion events; from our servers, hashed email and account identifier, IP address, user agent, click identifiers, payment amount | US | — |
| TikTok / ByteDance (TikTok Pixel, Events API) | Advertising measurement: the pixel in the app and on wevion.ai, and conversions sent by our servers | Page visits, browser identifiers, conversion events; from our servers, hashed email and account identifier, payment amount | China | — |
| X Corp. (X Pixel, Conversions API) | Advertising measurement: the pixel in the app and on wevion.ai, and conversions sent by our servers | Page visits, browser identifiers, conversion events; from our servers, hashed email, IP address, user agent, click identifier, payment amount | — | — |
| OpenAI (OpenAI Ads pixel) | Advertising measurement on wevion.ai | Page visits, browser identifiers, conversion events | US | — |
Sub-processors — CRM & marketing
| Provider | Purpose | Data categories | Location/Region | Transfer mechanism |
|---|---|---|---|---|
| Customer.io | CRM and lifecycle messaging (ACTIVE), in the app and on wevion.ai | Contact identity, event/messaging data | US | — |
| Klaviyo | Newsletter sign-up on wevion.ai | Email address entered in the newsletter form | — | — |
Sub-processors — Support & feedback
The support migration completed on 7 July 2026. Featurebase is the only support provider processing data today; Pylon is listed because ticket data created before that date is still held in its systems.
| Provider | Purpose | Data categories | Location/Region | Transfer mechanism |
|---|---|---|---|---|
| Featurebase | Customer support, feedback / feature requests / changelog | Support contact data, ticket content, contact identity, feedback content | US (not yet confirmed) | — |
| Pylon — ceased 7 July 2026 | Customer support (historical data only) | Support contact data, ticket content created before 7 July 2026 | US (not yet confirmed) | — |
Sub-processors — Notifications & support chats
| Provider | Purpose | Data categories | Location/Region | Transfer mechanism |
|---|---|---|---|---|
| Telegram | Notification delivery; customer support chats with our team | Notification content, Telegram chat/user identifier, messages you exchange with our support team | — | — |
| Slack | Internal notifications to our team | Email address of new sign-ups; customer and company names in billing alerts | — | — |
Sub-processors — Ad platforms & commerce (recipients on account connection)
These providers generally receive data only when you connect your own ad-platform account or activate server-side tracking / conversion APIs. Where you connect them, you and Wevion each play a role in the processing (see the Meta note below on joint controllership).
| Provider | Purpose | Data categories | Location/Region | Transfer mechanism |
|---|---|---|---|---|
| Meta | Ad management + Meta Business Tools / Conversions API | Campaign data, hashed conversion/PII events | US | — (see Art. 26 note) |
| TikTok / ByteDance | Ads + Pixel / Events API | Campaign data, hashed conversion/PII events | China | SCC + supplementary measures + TIA (not yet confirmed) — high risk |
| Google Ads | Ad management + conversion measurement | Campaign data, conversion events | US | — |
| Taboola | Native ad management | Campaign data, conversion events | — | — |
| Outbrain | Native ad management | Campaign data, conversion events | — | — |
| Snapchat | Ad management + conversion events | Campaign data, conversion events | — | — |
| ExoClick | Ad management (campaigns and reporting) | Campaign data, creatives, performance data | — | — |
| Shopify | Commerce / store data integration | Order/store data from your connected store | Your store's region (not yet confirmed) | — |
| WooCommerce | Commerce / store data integration | Order/store data from your connected store | Your store's region (not yet confirmed) | — |
High-risk transfers outside the EU
Some sub-processors process personal data outside the EU/EEA in countries that are not covered by an EU adequacy decision. We flag these explicitly because they carry higher transfer risk and require additional safeguards:
- DeepSeek (China) — receives user prompts and content for LLM generation; the default model in production.
- Moonshot / Kimi (China) — long-context LLM; receives user prompts and content.
- TikTok / ByteDance (China) — Pixel + Events API; receives conversion events including hashed PII when you connect TikTok, and measurement data from the TikTok Pixel we run on our own app and website and from the conversions our servers send (hashed email and account identifier).
- PostHog (US host) — product analytics on the default US host
us.i.posthog.com(not the EU host).
For these transfers our position is that they require Standard Contractual Clauses (SCC) + supplementary measures + a Transfer Impact Assessment (TIA). The existence and adequacy of these safeguards for each of the above is not yet confirmed. Microsoft Clarity and the other US-based providers are also non-EU transfers and rely on transfer mechanisms (SCC and/or Data Privacy Framework) that are not yet confirmed for each provider.
- China: DeepSeek, Moonshot/Kimi, TikTok — SCC + supplementary measures + TIA (not yet confirmed).
- US host analytics: PostHog (us.i.posthog.com), Microsoft Clarity — transfer mechanism not yet confirmed.
Active vs activatable sub-processors
Not every wired provider is processing data today. Where a provider is gated behind a feature flag or is only invoked in specific configurations, it becomes an active sub-processor only when enabled.
- Customer.io — ACTIVE: our CRM and lifecycle-messaging provider since 9 July 2026.
- Support (Featurebase) — ACTIVE: our sole support provider since 7 July 2026. It handles in-app chat, feedback and the knowledge base.
- Support (Pylon) — CEASED 7 July 2026: no support data has been sent to Pylon since that date. The in-app chat widget is disabled in production, and knowledge-base search is served by Featurebase. Ticket data created before that date remains in Pylon's systems.
- ExoClick — ACTIVE: the ExoClick ad connector is switched on for all accounts; data reaches ExoClick only when you connect your ExoClick account.
- Firebase Cloud Messaging (Google) — NOT ACTIVE: wired for push notifications in the mobile apps but switched off in production; we do not send notifications through it.
- AI models: all listed AI providers are wired; which one processes a given request depends on runtime model routing/configuration. In production the default model is DeepSeek.
Meta Business Tools — joint controllership (Article 26)
When you connect Meta and use Meta Business Tools (e.g. Pixel / Conversions API), Meta and the advertiser (you), together with Wevion where applicable, may act as joint controllers under Article 26 GDPR for certain processing of event data. That relationship is governed by Meta's Business Tools terms and the applicable joint-controller arrangement, which allocate responsibilities between the parties. Meta's role here is therefore not purely that of a sub-processor for all processing; the Article 26 arrangement applies to the joint-controllership portion. The details are not yet confirmed.
How we notify changes and your right to object
We keep this page current as our provider set evolves. Before we add a new sub-processor or replace an existing one, we give at least 30 days' notice by email and in-app notice, as set out in section 7 of the Data Processing Agreement, and we publish the change here with a new version and date. You may object on reasonable data-protection grounds within that period. If we cannot resolve your objection, you may terminate the affected part of the Service, with a pro-rata refund of fees paid for the unused period. Continuing to use the service after a change takes effect constitutes acceptance of the updated list.
- We publish changes here with a new version and date.
- We give at least 30 days' notice by email and in-app before adding or replacing a sub-processor.
- You can object on data-protection grounds within the notice period.
- If we can't resolve your objection, you may terminate the affected part of the Service with a pro-rata refund.
Note — data recipients on connection / server-side tracking
Many providers on this list — in particular the ad platforms and commerce integrations (Meta, TikTok, Google Ads, Taboola, Outbrain, Snapchat, ExoClick, Shopify, WooCommerce) — only become data recipients when you connect your own ad-platform or store account, or when you activate server-side tracking / conversion APIs. Until you enable those integrations, no personal data from your ad or store accounts flows to them through Wevion. Separately, Meta, TikTok, Google, X and OpenAI receive data from the measurement tags we run on our own app and website, and Meta, TikTok and X also receive conversion data from our servers when someone signs up, adds a card to the trial or pays, and Meta and TikTok when someone first spends on advertising: a hashed email address, plus the other data listed under 'Analytics & advertising measurement'. When you enable them, you instruct that data flow, and the provider's own terms and (where relevant) joint-controller arrangements also apply.
Contact
Controller: Bhblasted SRL SB, Via Boscofangone SNC, Zona ASI, Lotto C8, 80035 Nola (NA), Italy — VAT IT08466861211.
For any question about this list, our sub-processors or your data-protection rights, contact us at privacy@wevion.ai. This page is governed by Italian law and the GDPR.