Subprocessors
About this translation. This is an English translation of the Spanish original, provided for convenience. If the two versions differ, the Spanish version prevails.
These are the providers that process data on behalf of Calendulab Digital, S.L.U. to provide naab AI. Each one processes only the data needed for its function. With each of them we have accepted their data processing agreement (Art. 28 GDPR), incorporated into their terms of service. We'll notify clients before adding or replacing a subprocessor, as provided in the Terms of service.
Subprocessors in use
| Provider | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Google Cloud Google Cloud EMEA Limited (Ireland) |
Hosting of the application, database, file storage, task queues, secrets management and technical logs. | All of the service's data. | European Union: Belgium (europe-west1). Automatic database backups in the Netherlands (europe-west4) and manual backups in the European Union multi-region (eu). Technical logs are stored in a global Google location. |
Google Cloud data processing addendum. For logs in a global location, the standard contractual clauses incorporated in that addendum. |
| OpenAI OpenAI Ireland Ltd (Ireland) |
Computing the representations (embeddings) that let documents be searched by meaning. | Document text and the text of document searches. | United States | OpenAI data processing addendum with standard contractual clauses. |
Language model for summarizing documents and proposing the brand profile
naab summarizes documents and proposes the brand profile with a language model that is chosen in its internal configuration among these three providers. The one configured receives the text of the documents and the excerpts of the documents marked as context. All three are listed here, with their safeguards, because the configuration can switch between them without this list changing.
Our team's internal assistant (“Nerd”), which isn't available to clients, uses models from OpenAI and Anthropic depending on its configuration. It isn't enabled in production today.
| Provider | Location | Transfer safeguard |
|---|---|---|
| OpenAI OpenAI Ireland Ltd (Ireland) |
United States | OpenAI data processing addendum with standard contractual clauses. |
| Anthropic Anthropic Ireland, Limited (Ireland) |
United States | Anthropic data processing addendum with standard contractual clauses. |
| Google (Gemini API) Google LLC (United States), billed through the Google Cloud account |
United States; under its terms it may process in any country where Google has facilities | Google data processing addendum with standard contractual clauses. |
Managed service only
When the Calendulab team manages the client's accounts with naab, it also works with these providers, which process client data on our behalf.
| Provider | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Calendulab team's AI assistants Claude (Anthropic Ireland, Limited) and ChatGPT (OpenAI Ireland Ltd), on business or API plans |
Querying and working the client's accounts through naab's MCP connector. Only on plans whose terms exclude using the data to train models. | Whatever the team queries: metrics, campaigns, search terms, tasks, documents and brand context. | United States | Anthropic and OpenAI data processing addenda with standard contractual clauses. |
| Windsor.ai Windsor Group AG (Switzerland) |
Reading the metrics and campaigns from the client's advertising platforms when the source is connected “via Windsor” with Calendulab's account. | Metrics and campaigns from those accounts. | Switzerland | European Commission adequacy decision for Switzerland (Art. 45 GDPR) and Windsor's GDPR annex. |
Competitor analysis
In the competitor analysis module, naab is the data controller (see section 14 of the privacy policy). These providers process public information about other brands on our behalf; they don't receive our clients' content. The data is stored on Google Cloud, like the rest of the service.
| Provider | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Bright Data Bright Data Ltd (Israel) |
Accessing other brands' public web pages, including review pages, through its network of proxies and browsers. | Other brands' public pages and published reviews, with their authors' names. | Israel | European Commission adequacy decision for Israel (Art. 45 GDPR) and Bright Data's data protection addendum. |
| Apify Apify Technologies s.r.o. (Czech Republic) |
Reading public social media posts and profiles. | Other brands' public posts, the accounts they mention or tag and those accounts' public profiles. | European Union (Czech Republic) | No international transfer: processing in the European Union, under its data processing addendum. |
| OpenAI OpenAI Ireland Ltd (Ireland) |
Classifying the text of posts (content type, product category, whether it announces a promotion). | Text, hashtags and tagged accounts of the posts. | United States | OpenAI data processing addendum with standard contractual clauses. |
Planned
| Provider | Purpose | Status |
|---|---|---|
| Stripe | Collecting subscription payments and invoicing. | Planned for when there is billing. Not in use yet. Before enabling it we'll add its entity, location and safeguards here. |
Who isn't a naab subprocessor
- Google, Meta and the other platforms you connect (Google Ads, Meta Ads, Google Analytics 4 and the rest of the catalog). They're the source of your data: naab accesses them with your authorization and only to read.
- Your AI assistant, if you sign up for it yourself (for example, Claude or ChatGPT) and connect it via MCP. It receives the data you ask naab for and processes it under your terms with its provider. The assistants our team uses in the managed service are subprocessors (see above).
- Windsor.ai, if you connect a source “via Windsor” with your own key. naab queries it with that key, so Windsor acts as your provider. If our team connects it with Calendulab's account, it's a subprocessor (see above).
- Public data sources: Open-Meteo (weather), OpenHolidays API (public holidays and school vacations), European Central Bank (exchange rates) and Eurostat (economic indicators). They only receive the country, region or location configured in a workspace, never personal data.
Contact
If you have questions about this list, write to us at hi@naab.ai. You can read how we process data in the Privacy policy.