AimRank uses a small set of vetted subprocessors to operate the Service. This page is the canonical reference cited by our Privacy Policy §6 (Data Sharing) and the Data Processing Agreement we sign with business customers. Each subprocessor below has its own DPA with us; we impose data-protection obligations on each one that are no less protective than those we owe you under GDPR Art. 28(4).

What changed, and one gap we would rather state than let this page imply away. Until 21 September 2026 the infrastructure rows on this page still described an Amazon Web Services stack (hosting, Bedrock inference, SES email) that was retired on 8 July 2026. Production runs on OVHcloud, with OVH AI Endpoints for inference and Brevo for transactional email. The rows below were reconciled to Privacy Policy §6; if the two ever disagree, §6 is authoritative. On 9 October 2026 three more rows were corrected: a Sentry row (with an internal "confirm before signing" note left in it) is gone, because error reports go to GlitchTip, which we run on the OVHcloud infrastructure above; Google and GitHub moved out of the table, because social sign-in is not currently offered; and Omnisend, which receives paid-plan waitlist addresses, was added. The SaleSnail row is published here as disclosure of a live data flow that begins the moment our landing page loads; its processing agreement is not yet executed, so unlike every other row it should not be relied on in a signed DPA until it is.

Change notification: we publish proposed additions to this list at least 30 days before they go live. If you are a controller with a signed AimRank DPA and you want to object to a new subprocessor on data-protection grounds, write to privacy@aimrank.io and we will work with you under the DPA §5 objection process.

OVHcloud (OVH SAS, France)

Service: Compute, managed database, object storage
Purpose: Hosts the AimRank application, the Managed PostgreSQL database and S3-compatible Object Storage for uploaded media. In production since 8 July 2026. Also hosts our self-run GlitchTip error tracker (errors.aimrank.io), so error reports stay on this infrastructure.
Data categories: All Personal Data processed in the Service (Account Data, Vote Data, Audit Logs, error reports)
Region: DE1 region (Germany). Single region; there is no secondary or disaster-recovery region.
Transfer mechanism: Processor established in the EU (France); data stored in the EU (Germany). No third-country transfer for primary processing.
Vendor DPA: https://www.ovhcloud.com/en-ie/personal-data-protection/

OVH AI Endpoints (OVH SAS, France)

Service: LLM-as-judge inference
Purpose: When a ranking owner enables LLM-judge votes (Article 50 disclosed), the Qwen3.5-397B-A17B model processes content snippets to produce preference judgments. In production since 9 July 2026. The live answer to "which model is judging" is always GET /api/v1/judges/list.
Data categories: Pseudonymised entity content (no Account Data; voter_id is null on judge votes)
Region: EU (OVH AI Endpoints)
Transfer mechanism: EU-to-EU; same contracting entity as hosting.
Vendor DPA: https://www.ovhcloud.com/en-ie/personal-data-protection/

Stripe Payments Europe Limited (Ireland)

Service: Subscription billing + payment processing
Purpose: Will process Creator / Scale / Business / Enterprise subscriptions, invoicing, payment-method tokenisation and VAT-OSS receipts once paid plans open. They are not open yet, so no payment data is collected today.
Data categories: Billing email, address, payment-method tokens (no card numbers stored by AimRank), Stripe customer ID
Region: EU (Stripe Ireland). Some pseudonymous tokens may transit US-located Stripe infrastructure under approved transfer mechanism.
Transfer mechanism: Stripe SCCs + Data Protection Framework (where applicable)
Vendor DPA: https://stripe.com/legal/dpa

Brevo (Sendinblue SAS, France)

Service: Transactional email delivery
Purpose: Sends verification emails and password resets. In production since 29 August 2026. No marketing emails without separate consent.
Data categories: Email address, email subject + body, delivery metadata
Region: EU
Transfer mechanism: Processor established in the EU (France).
Vendor DPA: https://www.brevo.com/gdpr/

PostHog Inc. (EU)

Service: Product analytics (opt-in only)
Purpose: When a visitor explicitly consents via the Cookie Banner, we record pageviews + autocaptured UI events for funnel/retention analysis. No PII captured. Session replay is disabled.
Data categories: Anonymous distinct_id (localStorage), URL paths, click + form-submission events, UTM parameters
Region: EU instance (eu.i.posthog.com, Frankfurt)
Transfer mechanism: EU-only when on the EU instance
Vendor DPA: https://posthog.com/handbook/growth/security/dpa

Omnisend (Lithuania)

Service: Marketing email list
Purpose: When a visitor asks to be told that paid plans have opened, the address is mirrored from our own database into Omnisend, marked as subscribed and tagged with the interest picked, for that announcement and other product news. Every email carries an unsubscribe link. [VERIFY: confirm whether OMNISEND_API_KEY is set in production; if it is not, nothing reaches Omnisend and this row should say so.]
Data categories: Email address, the interest picked (for example "pricing") and the page it came from
Region: [VERIFY: Omnisend hosting region]
Transfer mechanism: [VERIFY: contracting entity, transfer mechanism and the vendor DPA link]
Vendor DPA: https://www.omnisend.com/

SaleSnail

Service: AI chat assistant on the landing page
Purpose: Answers visitor questions from the chat bubble on the AimRank landing page. The assistant is a large language model and says so in its own panel header, per EU AI Act Art. 50(1). It has no access to AimRank accounts, rankings, votes or eval data.
Data categories: Whatever the visitor types into the chat, plus identifiers the widget mints: an install flag in localStorage when the landing page loads, and — from the moment the chat panel is opened — a conversation id, a visitor id, a session proof and a partitioned HttpOnly cookie scoped to the chat API
Region: EU — Microsoft Azure, Sweden Central (resolved and verified 2026-09-19)
Transfer mechanism: EU-to-EU. No third-country transfer identified for the widget's own traffic.
Vendor DPA: https://salesnail.io/privacy

Not subprocessors (excluded by design)

OpenAI, Google Gemini, xAI: AimRank does not call these as judges. The production judge is Qwen3.5-397B-A17B on OVH AI Endpoints.
Amazon Web Services, Anthropic: not used to host the Service, run the LLM judge or send email. Amazon Route 53 still provides DNS for the aimrank.io domain.
Sentry (Functional Software, Inc.): not used. Error reports go to GlitchTip, which we run ourselves on the OVHcloud infrastructure listed above.
Google, GitHub: social sign-in is not currently offered, so no data goes to either. If we switch it on, they are added here first, under the notice period above.
Scale AI, Surge AI, Mercor: AimRank does not subcontract labelling to US-hosted preference-data vendors. Expert labellers are recruited and engaged directly under the L4 program.
Customer-controlled LLM endpoints: if a customer routes their own model through AimRank for evaluation, that endpoint is the customer's processor, not ours.

Contact

Questions, subprocessor objections, or DPA requests: privacy@aimrank.io. EU AI Act and supply-chain compliance questions are handled by iCOMPLY, our sister AI Act audit SaaS.

Subprocessors