Sub-processor list

Jamey S.à r.l.s, 177 Rue de Luxembourg, L-8077 Bertrange, Luxembourg (Trade and Companies Register no. B288826) engages the sub-processors below to deliver the Services described in our Terms of Service and Privacy & Data Handling Notice.

Where Jamey acts as processor for a business customer's workspace and guest data, these providers act as our sub-processors. Where Jamey acts as controller (accounts, billing, support, security logging), they act as our processors.

Questions or objections: privacy@jamey.lu. We aim to notify business customers of a new or replaced sub-processor before it starts processing their data, and we date every change to this page.

Personal data belonging to a guest of a business (a B2B2C consumer) are shared only with the business that person actually interacted with, and with the providers listed on this page acting under contract. We never disclose one business's guest data to another business and we never sell guest data. Where a person reuses one Jamey Account across several participating businesses, each business sees only the orders, bookings, loyalty balances and contact details arising from its own relationship with that person.

The application and the primary database are pinned to Frankfurt. Several providers further down this page are US-based or US-operated; each of those relationships is covered by EU Standard Contractual Clauses or the provider's own transfer framework.

A guest signed in on a business's own domain holds a short-lived, origin-bound bearer token (one hour, or twelve hours if they asked to be remembered) held in browser storage rather than a long-lived cookie.

Business and beneficial-owner verification for connected accounts is performed by Stripe and its regulated partners, not by Jamey. Connect direct charges place the merchant relationship, and chargeback liability, with the business.

These providers support website generation, content drafting and onboarding. Guest personal data are not deliberately sent to any of them and the platform is not designed to route guest records to them. Free-text fields are the residual risk: if a business types a person's name into a field an AI feature then reads, that name would reach a model provider. The platform does not scan for that, so we do not claim that personal data can never reach an AI provider.

Frankfurt covers the application and the primary database, not the whole provider list. OpenAI, fal.ai, Browserless, Firecrawl, OpenRouter, Microsoft and Meta are US-based or US-operated, and Vercel, Google and Stripe involve group processing in the United States.

Each of those relationships is covered by a transfer mechanism — EU Standard Contractual Clauses, an adequacy decision, or the provider's own data-processing agreement — together with supplementary measures where required.

We update this page whenever a sub-processor is added, replaced or removed, and we record the date at the top of the page.

If a business customer reasonably objects to a new sub-processor on data-protection grounds, we will discuss a workable alternative or, where none exists, the customer may terminate the affected part of the Services as described in the Terms of Service.