Sub-processor list
The providers below process personal data on Jamey's behalf when we operate Jamey.lu. We publish this list so business customers can review it and can assess changes before they take effect. The English version is authoritative.
Effective 19 August 2026 · Last updated 19 August 2026
1. How to use this list
Jamey S.à r.l.s, 177 Rue de Luxembourg, L-8077 Bertrange, Luxembourg (Trade and Companies Register no. B288826) engages the sub-processors below to deliver the Services described in our Terms of Service and Privacy & Data Handling Notice.
Where Jamey acts as processor for a business customer's workspace data, these providers act as our sub-processors. Where Jamey acts as controller (accounts, billing, support, security logging), they act as our processors.
Questions or objections: privacy@jamey.lu. We aim to notify business customers of a new or replaced sub-processor before it starts processing their data.
2. Hosting, application platform and data storage
| Provider | Role in the Services | Processing locations | Transfer safeguard |
|---|---|---|---|
| Vercel Inc. | Hosting and delivery of the Jamey web application and server functions | Production compute and data regions in the EU; global CDN/edge points of presence and provider support access may involve non-EEA processing | EU Standard Contractual Clauses with supplementary measures where processing occurs outside the EEA |
| Supabase, Inc. | Managed PostgreSQL database and authentication for business and account data | EU region for the primary database; backups, logs and any read replicas are configured in the EU | EU Standard Contractual Clauses for provider support access outside the EEA |
| BunnyWay d.o.o. (Bunny CDN) | European CDN storage and delivery of images, menus, documents and other files uploaded to a workspace, served to visitors from the Bunny CDN edge network | EU (European edge network and storage regions) | EU Standard Contractual Clauses for any support access outside the EEA |
3. Identity and login
| Provider | Role in the Services | Processing locations | Transfer safeguard |
|---|---|---|---|
| Supabase Auth (Supabase, Inc.) | Jamey Account identity, magic-link and single-sign-on authentication, session management | EU | EU Standard Contractual Clauses |
| Federated identity providers chosen by the user (for example Google, Apple) | Optional single sign-on where the person chooses that login method | Depends on the provider; typically global | Independent controller for its own account data; transfers governed by that provider's own framework |
4. Payments
Business and beneficial-owner verification for connected accounts is performed by Stripe and its regulated partners, not by Jamey.
| Provider | Role in the Services | Processing locations | Transfer safeguard |
|---|---|---|---|
| Stripe Payments Europe, Ltd. and Stripe, Inc. (Stripe Connect) | Card processing, checkout, connected-account onboarding and payouts to business customers, platform fee collection, refunds and disputes | EU with group processing in the United States | EU Standard Contractual Clauses; Stripe acts as an independent controller for regulated activities |
5. Messaging, email and support
| Provider | Role in the Services | Processing locations | Transfer safeguard |
|---|---|---|---|
| WhatsApp Business Platform (Meta Platforms Ireland Ltd.) | The WhatsApp workspace channel used by business customers to edit content and receive event notifications; customer marketing messages where a business enables them | EU with group processing outside the EEA | EU Standard Contractual Clauses and Meta's transfer framework |
| Postmark (Active Campaign, LLC; Wildbit operating brand) | Account, security, billing and magic-link emails sent by Jamey, and the optional email-inbox service that lets business customers run their own branded inbox without configuring a separate mail client | EU | EU Standard Contractual Clauses where support access occurs outside the EEA |
| Support desk provider | Handling of support conversations and tickets addressed to Jamey | EU | EU Standard Contractual Clauses |
6. AI features
Jamey maintains an approved model and endpoint allow-list. Provider training on Jamey traffic is disabled, prompt logging is limited to what is needed to operate and secure the feature, and zero-data-retention endpoints are preferred where available.
Business customers should not place special-category or otherwise sensitive CRM data into AI features unless an approved configuration and appropriate safeguards are in place.
| Provider | Role in the Services | Processing locations | Transfer safeguard |
|---|---|---|---|
| OpenRouter, Inc. | Routing of AI requests from Jamey's AI features to approved model endpoints | United States with model endpoints in several regions | EU Standard Contractual Clauses |
| Approved model providers on the Jamey allow-list | Generation of drafted answers, summaries and scheduling suggestions requested through the Services | Depends on the endpoint selected from the allow-list | EU Standard Contractual Clauses via the routing provider's terms |
7. Changes to this list
We update this page whenever a sub-processor is added, replaced or removed, and we record the date at the top of the page.
If a business customer reasonably objects to a new sub-processor on data-protection grounds, we will discuss a workable alternative or, where none exists, the customer may terminate the affected part of the Services as described in the Terms of Service.