Sub-processors

Transfers outside the EU that carry higher risk

Some sub-processors process personal data outside the EU/EEA, in countries not covered by an EU adequacy decision. We flag them here because they carry higher transfer risk and need additional safeguards. Our position is that these transfers require Standard Contractual Clauses, supplementary measures and a Transfer Impact Assessment. For the documentation that applies to your contract, write to privacy@wevion.ai.

• DeepSeek (China) — receives prompts and content for LLM generation.
• Moonshot / Kimi (China) — long-context LLM; receives prompts and content.
• TikTok / ByteDance (China) — Pixel and Events API; receives conversion events, including hashed personal data, once you connect TikTok.
• PostHog (US host) — product analytics on the default US host, not the EU one.
• Microsoft Clarity, AWS SES (us-east-1) and the other US providers are non-EU transfers too, while AWS S3 and SQS stay in eu-west-1.

Active and activatable

Not every wired provider is processing data today. Where a provider sits behind a feature flag, or is only used in certain configurations, it becomes an active sub-processor when it is enabled. Customer.io has been our CRM and lifecycle-messaging provider since 9 July 2026. Featurebase processes feedback data. The support migration completed in August 2026: Pylon is no longer wired and no longer processes any data.

Providers that receive data only when you connect an account

Meta, TikTok, Google Ads, Taboola, Outbrain, Snapchat, Shopify and WooCommerce become data recipients only when you connect your own ad-platform or store account, or when you switch on server-side tracking and conversion APIs. Until you enable those integrations, no personal data reaches them through Wevion. When you do enable them, you instruct that flow, and the provider's own terms apply as well.

Meta Business Tools — joint controllership (Article 26)

When you connect Meta and use Meta Business Tools such as the Pixel or the Conversions API, Meta and you as the advertiser — together with Wevion where applicable — may act as joint controllers under Article 26 GDPR for part of the event-data processing. That part is governed by Meta's Business Tools terms and the applicable joint-controller arrangement, so Meta's role is not purely that of a sub-processor for all processing.

Changes to this list, and your right to object

By using Wevion you give us a general written authorisation under Article 28(2) GDPR to engage the sub-processors on this page and to add or replace them over time. Before we add a new sub-processor or replace an existing one, we give you advance notice — on this page, with an updated version and date, and by email or in-product notice where appropriate. You may object on reasonable data-protection grounds within the notice period; if we cannot resolve the objection, you may be able to suspend or terminate the affected service under your agreement with us. Every sub-processor is bound by data-protection obligations no less protective than those in our agreement with you, and we remain responsible to you for what they do.