Sub-processors
Last updated: 25 April 2026
This page lists every sub-processor that handles WaysOfBeing user personal data, the purpose of processing, the region where data is processed, and the transfer mechanism for any cross-border flow.
Material changes — adding a new sub-processor, a new processing purpose, or a new non-EU transfer — are notified at least 30 days in advance and trigger the policy-refresh flow described in our Privacy Policy §13.
Active sub-processors
| Sub-processor | Region | Purpose | Transfer mechanism | DPA |
|---|---|---|---|---|
| Mistral AI SAS | European Union (France) | LLM inference for coaching flows, analysis, reports, AI assistant, CRM. Speech-to-text (Voxtral). Data: Coaching prompts and completions; voice transcript text. API ToS — no training on customer data. | Adequacy (intra-EU). | link |
| OpenAI, OpC LLC | United States | LLM inference for the payroll assistant only (B2B HR surface, non-coaching). Text-to-speech. Data: Payroll-domain prompts (no coaching content); TTS source text. API ToS post-2023 — no training on API data. | Standard Contractual Clauses (2021); Transfer Impact Assessment on file. | link |
| Google LLC (Gemini API) | United States | LLM for legal-text analysis (non-WoB user data). Data: Legal documents only; no WoB user coaching content. Gemini API paid tier — no training. | Standard Contractual Clauses; TIA on file. | link |
| Anthropic, PBC | United States | LLM for internal AjielSoft assistant tooling (not currently used for WoB user data). Data: Internal-tool prompts only. API ToS — no training on API inputs. | Standard Contractual Clauses; TIA on file. | link |
| Hetzner Online GmbH | European Union (Germany / Finland) | Primary hosting (compute, database, encrypted backups). Data: All WaysOfBeing application data. | Adequacy (intra-EU). | link |
| Cloudflare, Inc. (R2 object storage) | EU jurisdiction-pinned bucket | Object storage for coach portraits, voice notes, generated documents, data exports. Data: User-uploaded files, voice recordings, generated PDFs. | Standard Contractual Clauses + EU jurisdiction tag on bucket. | link |
| SAS Gandi | European Union (France) | Transactional email (signup OTP, password reset, notifications, exports). Data: Email address, plaintext email body (transactional only — no coaching content). | Adequacy (intra-EU). | link |
| Stripe Payments Europe Ltd / Stripe, Inc. | Ireland (EEA cardholders) / United States (fallback) | Payment processing. Data: Identity, billing address, payment-method token, transaction history. | Adequacy for Stripe EU; Standard Contractual Clauses for Stripe US; TIA on file. | link |
| Google Ireland Ltd (Google Sign-In) | European Union (Ireland) | Federated authentication for users who choose Sign in with Google. Data: Email, name, Google subject ID — only at the OAuth flow. | Adequacy (intra-EU) for the Workspace data; Google is independent controller for the user's Google account. | link |
| Google LLC (Google Analytics 4) | United States | Marketing-site analytics on www.waysofbeing.ai (with consent only). Data: Pseudonymous client ID, IP-anonymized, page paths, scroll, conversions. IP anonymization on; data not stored/shared with other Google services. | Standard Contractual Clauses + Consent Mode v2; TIA on file. | link |
| WaysOfBeing OÜ self-hosted n8n | European Union (Hetzner Germany) | Workflow automation (transactional email orchestration, notifications, support). Data: Transactional metadata. | Internal — same controller, no transfer. | n/a (self-hosted by WaysOfBeing OÜ) |
Where coaching content is processed
All coaching content (assessments, transcripts, voice, AI threads) is processed exclusively in the European Union — Mistral AI (France) and Hetzner (Germany / Finland). The US-based sub-processors above receive non-coaching data (payroll prompts, TTS source text, marketing analytics, payments).
How to request our DPA
Enterprise customers can request our standard Data Processing Addendum by emailing support@waysofbeing.ai. We are working on publishing the DPA as a self-serve PDF — that page will live at /legal/dpa.
Sub-processor notification
To be notified by email when this list changes, contact support@waysofbeing.ai. Enterprise customers receive notifications under their platform agreement.