Legal
Sub-processors
The third parties that process personal data on our behalf, what they receive, where they are, and how international transfers to them are protected.
On this page
A sub-processor is a company we engage that handles personal data for us: for our own website, demo and sales channels (where we are the controller), and for customers when we host or support their deployment (where we are their processor, under our Data Processing Addendum). We announce changes on this page at least 30 days before a new sub-processor starts handling customer personal data; see changes and objections.
01Website, hosted demo and hosted pilots
| Sub-processor | What it does for us | Personal data it handles | Location | Transfer safeguard |
|---|---|---|---|---|
| Amazon Web Services, Inc. (Amazon EC2) | Hosts the website, the hosted demo and their databases | Everything the website and demo keep: form submissions, demo accounts and activity, agent conversations, audit log | Australia (Asia Pacific, Sydney region) | Standard Contractual Clauses in the AWS Data Processing Addendum |
| Google LLC (Gmail SMTP relay) | Sends our email: privacy-request confirmations and answers, and internal notices of new requests | Recipient's name and email address, and the message | United States and other countries where Google operates | EU-U.S. Data Privacy Framework (Google is certified) and Standard Contractual Clauses |
| ImprovMX (email forwarding) | Receives email sent to our liyagent.com addresses (such as privacy@ and sales@) and forwards it to our inbox | The sender's name and email address, and the message | United States and Europe | Standard Contractual Clauses |
| Google LLC (Gemini API) | Runs AI models that the hosted demo's agents call | The text sent to the model (a demo user's question and the context the agent adds) and its answer | United States and other countries where Google operates | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Cerebras Systems Inc. (inference API) | Runs AI models that the hosted demo's agents call | The text sent to the model and its answer | United States | Standard Contractual Clauses |
| OpenRouter, Inc. | Routes some of the hosted demo's model calls to the model's host | The text sent to the model and its answer; OpenRouter passes it to the host of the model chosen | United States, and the location of the model host | Standard Contractual Clauses |
| Microsoft Corporation (Microsoft Teams, Azure Bot Service, Microsoft Entra ID) | Delivers messages between Microsoft Teams and our demo agent, and signs users in, when Teams is used | The Teams user's name, account identifier and email address, and the messages exchanged with the agent | Worldwide, per Microsoft's data residency commitments | EU-U.S. Data Privacy Framework (Microsoft is certified) and Standard Contractual Clauses |
The AI model providers receive only what an agent sends them while it answers. Guardrails can mask personal identifiers before text reaches them. Please do not enter real personal data into the hosted demo; it is set up with a fictional company's records.
02Self-hosted deployments
When a customer runs our platform in its own cloud or data centre and brings its own AI models, we use no sub-processors for it: the data stays in the customer's environment, and the model providers, identity providers and connected systems the customer chooses (for example Microsoft Teams, ServiceNow or Workday) are the customer's own providers, under the customer's own contracts with them. We see that data only if the customer gives us access, for example in a support session, and then only as its processor.
03Providers that are not sub-processors
| Provider | What it does | Why it is not a sub-processor |
|---|---|---|
| Wix.com Ltd. | Registrar and DNS for liyagent.com | Points the domain at our server; does not receive what you send to the website |
| Let's Encrypt (ISRG) | Issues the TLS certificate for HTTPS | Receives our domain name, not visitors' data |
| PostgreSQL, Qdrant, Caddy | Database, vector search and web server software | Open-source software we run on our own server; no third party operates it or receives data from it |
| LinkedIn (LinkedIn Ireland Unlimited Company) | Ad measurement on the public website, only if you accept it | What LinkedIn's Insight Tag collects (the page, your IP address and browser details, its cookies), as its own controller; never loaded before you accept, and not on the console. See our cookies section |
| GitHub, X | Linked from our pages | Plain links only: nothing is loaded from them until you click, and then their own policies apply |
04Changes and objections
We update this page, and its date, before a new sub-processor starts handling personal data. For customer personal data we give at least 30 days' notice: customers who want notice by email can ask privacy@liyagent.com. A customer may object on reasonable data protection grounds within that period; we will then work with it in good faith on an alternative, and if we cannot find one, it may end the affected service as the Data Processing Addendum describes.