Sub-Processor List
Effective Date: 28 May 2026 Last Updated: 28 May 2026
This page lists all third-party sub-processors that CTrend Ltd engages to process Personal Data on behalf of Controllers (operators). This list is maintained pursuant to Data Processing Agreement §5.
AI and Language Processing
| Sub-Processor | Location | Purpose | Data Processed | Transfer Mechanism |
|---|---|---|---|---|
| Anthropic PBC | United States | AI inference (Claude models) | Message content, conversation history, system prompts | UK IDTA / EU SCCs |
| OpenRouter Inc. | United States | AI model routing and inference | Message content, conversation history, system prompts | UK IDTA / EU SCCs |
| OpenAI Inc. | United States | AI inference, speech-to-text (Whisper), translation | Message content, audio files, text for translation | UK IDTA / EU SCCs |
| Groq Inc. | United States | Speech-to-text transcription (Whisper) | Audio files from voice messages | UK IDTA / EU SCCs |
| Google LLC | United States | Free translation service (server-side) | Text content of messages for translation | Google DPA + SCCs |
BYOK (Bring Your Own Key) Note
When operators provide their own API keys (BYOK), data flows directly from the CTrend platform to the operator's chosen AI provider using the operator's own credentials. In this configuration, the operator has a direct relationship with the AI provider. CTrend acts as a technical intermediary only.
Messaging Infrastructure
| Sub-Processor | Location | Purpose | Data Processed | Transfer Mechanism |
|---|---|---|---|---|
| Google LLC (Firebase Cloud Messaging) | United States | Push notifications to mobile app | Notification title and body text (max 200 chars), device tokens | Google DPA + SCCs |
| Evolution API (self-hosted) | Customer infrastructure | WhatsApp messaging via Baileys | Message content, phone numbers | N/A (self-hosted) |
Billing
| Sub-Processor | Location | Purpose | Data Processed | Transfer Mechanism |
|---|---|---|---|---|
| Paddle.com Market Ltd | United Kingdom | Payment processing (Merchant of Record) | Billing email, subscription status, payment method | N/A (UK-based) |
Operator-Configured Integrations
The following integrations are only active when explicitly configured by the operator. Data processing occurs under the operator's own credentials and agreements with these providers.
| Integration | Location | Purpose | Data Processed |
|---|---|---|---|
| HubSpot Inc. | United States | CRM contact sync (operator's HubSpot account) | Contact name, email, phone, custom fields |
| Google LLC (Calendar) | United States | Appointment booking (operator's Google account) | Calendar events, user email (OAuth) |
| Google LLC (Gmail, Drive, Sheets) | United States | Operator productivity tools via skills | Email drafts, file operations, spreadsheet data |
These integrations use the operator's own OAuth tokens or API keys. CTrend does not have independent access to the operator's accounts with these services.
Changes to This List
We update this list when adding or replacing sub-processors. Material changes are communicated via in-app notification or email to registered operators. If you object to a new sub-processor, you may terminate the Service within 30 days per DPA §5.3.
Contact
For questions about our sub-processors: privacy@ctrend.co.uk