This list forms Annex B of the Data Processing Agreement.

This page lists the sub-processors engaged by Breezee AI Limited (Company No. SC857320) to process personal data on behalf of Controllers under the Beta Access Agreement or the Terms and Conditions. It is maintained in accordance with Clause 4.3 of the breezee.ai/data-processing-agreement.

Controllers will be notified by email of any changes to this list, with no less than 14 days' notice before a new sub-processor is engaged.

Approved Sub-Processors

OpenAI, L.L.C.

Location: United States of America
Processing purpose: Large language model processing (GPT); generation of AI agent responses and vector embeddings for the knowledge base. Used alongside the Azure OpenAI Service below; which provider handles a given request is set by configuration. AI training uses only Anonymised Platform Data — see Clause 8 of the DPA.
Transfer safeguard: IDTA or UK Addendum to EU SCCs (Processor-to-Processor).

Microsoft Corporation (Azure OpenAI Service)

Location: United Kingdom — the deployment is in the UK South region
Processing purpose: Large language model processing for the generation of AI agent responses, on a UK-hosted Azure AI Foundry deployment. Used alongside OpenAI, L.L.C. above.
Transfer safeguard: None required — the processing takes place in the United Kingdom, so there is no Restricted Transfer.

Cohere Inc.

Location: Canada
Processing purpose: Semantic reranking of knowledge base search results. The visitor's question and the candidate passages retrieved for it are sent for relevance scoring, and may therefore contain personal data the visitor has typed into the conversation.
Transfer safeguard: Canada is the subject of a UK adequacy decision for commercial organisations, so no Restricted Transfer arises; the IDTA or UK Addendum to EU SCCs applies to any processing outside its scope.

Supabase, Inc.

Location: United States of America
Processing purpose: Database hosting (PostgreSQL + pgvector), authentication, file storage, and serverless edge function execution.
Transfer safeguard: IDTA or UK Addendum to EU SCCs (Processor-to-Processor).

Vercel, Inc.

Location: United States of America
Processing purpose: Frontend application hosting, serverless function execution, and content delivery network.
Transfer safeguard: IDTA or UK Addendum to EU SCCs (Processor-to-Processor).

Langfuse GmbH

Location: Germany (EEA)
Processing purpose: AI observability and tracing: logging of agent conversation metadata and tool call spans for quality monitoring. PII masking applied before export.
Transfer safeguard: No Restricted Transfer — EEA (UK adequacy decision applies).

Firecrawl

Location: United States of America
Processing purpose: Knowledge base ingestion. Discovers and retrieves pages from website addresses the Controller supplies, so their content can be indexed for the agent to draw on. Those pages are usually the Controller's own site, and published pages of that kind commonly contain personal data such as staff names and contact addresses.
Transfer safeguard: IDTA or UK Addendum to EU SCCs (Processor-to-Processor).

Unstructured

Location: United States of America
Processing purpose: Knowledge base ingestion. Parses documents the Controller uploads into structured text for indexing. Breezee AI does not control what a Controller chooses to upload, so these documents may contain personal data.
Transfer safeguard: IDTA or UK Addendum to EU SCCs (Processor-to-Processor).

Resend, Inc.

Location: United States of America
Processing purpose: Transactional email delivery: sending confirmation emails and platform notifications to authorised dashboard users.
Transfer safeguard: IDTA or UK Addendum to EU SCCs (Processor-to-Processor).

Atlassian, Inc.

Location: United States of America
Processing purpose: Bug tracking and support ticket management; tickets may contain personal data relating to the Controller's end users.
Transfer safeguard: IDTA or UK Addendum to EU SCCs (Processor-to-Processor).

Customer-connected integrations

These are services you hold an account with and choose to connect to the Platform. When you do, Breezee AI transmits data to them on your instruction. Each is engaged by you, under your own agreement with it, and is your processor rather than one of our sub-processors — so the DPA's sub-processor obligations, including Clause 4.2(c), do not apply to them. They are listed here so that the distinction is visible and so you can see exactly what leaves the Platform when you connect one.

HubSpot, Inc.

Location: United States of America
Role: CRM. If you connect your HubSpot account, lead and prospect records captured by your agent are written to it on your instruction.
Transfer safeguard: your responsibility as the account holder, under your agreement with the provider.

Zoho Corporation

Location: European Union — the platform connects to Zoho's EU instance
Role: CRM. If you connect your Zoho account, lead and prospect records captured by your agent are written to it on your instruction.
Transfer safeguard: your responsibility as the account holder, under your agreement with the provider.

Cal.com, Inc.

Location: United States of America, or the European Union where the Controller connects the EU-hosted instance
Role: Meeting scheduling. If you connect your Cal.com account, your agent checks availability and books meetings in it on your instruction, passing the prospect's name, email address and booking details.
Transfer safeguard: your responsibility as the account holder, under your agreement with the provider.

Notes

Transfer mechanisms. Breezee AI ensures that appropriate transfer safeguards (IDTA or UK Addendum to EU SCCs) are in place with each US-based sub-processor prior to any transfer of personal data, and conducts transfer impact assessments as required under Clause 6.3 of the DPA. Documentation is available on request.

Knowledge base ingestion. Content the Controller asks Breezee AI to ingest — web pages it nominates, and documents it uploads — is retrieved and parsed by the Sub-processors named above for that purpose. The Controller chooses what to ingest and remains responsible for having a lawful basis for the personal data contained in it, and for not uploading special category data (see Clause 2.3(d) of the DPA). Ingested content is processed to build the knowledge base the agent draws on; it is not used to train AI models, which use only Anonymised Platform Data under Clause 8.

This list is maintained by Breezee AI Limited. For data protection queries, contact privacy@breezee.ai. Full terms are available at: breezee.ai/data-processing-agreement