Subprocessors

This page lists every third party that may process personal data on our behalf when you use GPTpost. It forms Annex III of Data Processing Addendum and satisfies the subprocessor-disclosure obligation in Privacy Policy section 7.

Controller of record: GPT LLM ORAGLE Ltd. Liability Co., a Wyoming close limited liability company, registered office 30 N Gould St, Ste N, Sheridan, WY 82801, United States. Contact: dpa@oraglegpt.org.

We do not list a vendor here unless we actually use it. Categories we have deliberately not engaged are listed in section 5 as not engaged, so you can see what is absent as well as what is present.

1. Legend

Transfer mechanism column: Adequacy / EU-internal means no transfer tool is needed. SCCs means the European Commission Standard Contractual Clauses (Decision 2021/914), together with the UK International Data Transfer Addendum and the Swiss amendments where those apply.

2. Infrastructure and hosting

Contabo GmbH is established in Germany, so hosting personal data there requires no international transfer safeguard for EEA or UK customers. Uploaded media is held in object storage the Company runs on that same German infrastructure, so it is not transferred outside the EEA and no international transfer tool is required for it.

Cloudflare, Inc. proxies the marketing site oraglegpt.org, which is where the public policy pages are served from. As a reverse proxy it necessarily observes the IP address and request metadata of visitors to those pages. It does not sit in front of the application at app.oraglegpt.org or in front of uploaded media at media.oraglegpt.org; both resolve directly to our origin, so no Customer Personal Data held in a workspace passes through it.

3. Communications

This build sends no email of its own. The application contains no mail client and no email vendor library, and it exposes no email verification, password reset, invitation, or notification-delivery route, so none of the messages named in that row is generated or delivered by the Service. Where this site tells you to write to an address such as dpa@oraglegpt.org or privacy@oraglegpt.org, that is ordinary mailbox correspondence answered by a person, not product-generated mail, and no third-party email delivery platform receives your address or your message content. If we later add automated email, this row is updated first, and where that involves a vendor the notice period in section 8 applies before any message is routed through it.

4. AI model providers

The Service ships with no AI provider enabled by default. A workspace administrator configures one at settings/ai-providers, subject to that tenant's AI policy: allowed providers, allowed models, allowed tools, monthly budget, maximum output tokens, declared data region, and whether autonomous public actions are permitted. If no provider is configured, AI features either return a local fixture response that never leaves the deployment, or are unavailable.

Commitments that apply to every AI provider above:

1. Tenant content is not used to train a shared or public model. We do not grant any AI provider the right to train on Customer Personal Data or on Platform Data.
2. An AI call happens only when a tenant uses an AI feature. There is no background AI processing of your content.
3. We will not send Customer Personal Data to a provider the customer has not configured.
4. Whether a given provider retains prompts, and for how long, is governed by that provider's own terms. Customers who enable a provider must satisfy themselves about those terms.
5. Platform Data obtained from a social network is never sent to an AI provider for model training, in line with our commitments in Privacy Policy section 13.

5. Categories we have deliberately not engaged

Listing these matters as much as listing the vendors we do use, because it tells you which data flows do not exist.

6. Social platforms are recipients, not subprocessors

When a customer connects an account, the Service exchanges data with that platform. Platforms are independent controllers of the data they hold, not subprocessors of the Company, because they determine their own purposes and means. They are listed here for transparency.

This build's connectors are publish-only. Every call the Service makes to a social platform is one of three things: an OAuth authorisation, token exchange or refresh; a publish call; or, for Facebook, TikTok, Reddit and Snapchat, a single identity lookup at connection time that resolves which account was connected. There is no inbox or message fetcher, no comment or mention fetcher, no insights or analytics call, and no delete, hide, like, or moderation call for any platform in this build. So the "received" column below is limited to what an OAuth response, that one identity lookup, and a publish response contain.

Most of the platforms in this table cannot be connected in this release, so no data flows to them at all. The table describes what each connector would send and receive, because that is what a customer needs to know before connecting. Today the only platforms an account can actually be connected to are Facebook Pages, Instagram Professional, Threads and TikTok through OAuth, and Bluesky, Telegram, Discord and WordPress using a credential the customer supplies for that account. Every other row is dormant: the connector has no account-identity resolver in this build, or a provider-approval policy blocks it, so the authorisation flow refuses to start and nothing is transmitted. The live answer is GET /api/v1/capabilities, which reports oauth_connectable per provider and the reason when it is false.

Each platform's own privacy policy governs what it does with that data.

Where a customer's own systems bring platform conversations or metrics into GPTpost through the ingest APIs described in Privacy Policy sections 4.4 and 4.5, that data reaches us from the customer, not from the platform, and the customer is responsible for having obtained it lawfully.

7. Company affiliates

The Company has no subsidiaries and no affiliates. If that changes, any affiliate that processes Customer Personal Data will be added to this page under the same notice period as any other subprocessor.

8. Notice of changes

1. We will publish an update to this page and give at least 30 days' notice before a new subprocessor starts processing Customer Personal Data.
2. To receive those notices by email, write to dpa@oraglegpt.org and ask to be added to the subprocessor notification list. We maintain that list manually and confirm each subscription.
3. A customer may object on reasonable data protection grounds within the notice period, under Data Processing Addendum section 7. If the objection cannot be resolved, the customer may terminate the affected part of the Service without penalty and receive a pro-rata refund of prepaid unused fees.
4. Where a change is urgent, for example replacing a vendor after a security incident, we may act first and notify immediately afterwards with reasons.

9. What we require of every subprocessor

1. A written contract containing GDPR Article 28(3) terms.
2. A documented international transfer mechanism where the vendor is outside the EEA, the UK, or Switzerland.
3. Confidentiality obligations binding on personnel with access.
4. Security measures no less protective than those in Annex II of Data Processing Addendum.
5. An obligation to assist with data subject requests and breach notification.
6. Deletion or return of data at the end of the engagement.
7. A prohibition on using our data, or Customer Personal Data, for the vendor's own purposes.

10. Version history

11. Contact

GPT LLM ORAGLE Ltd. Liability Co.
30 N Gould St, Ste N
Sheridan, WY 82801
United States