Sub-processors List

Data Processors pursuant to GDPR Art. 28

Last updated: 2026-03-15

Transparency Notice: This list contains all third-party providers (sub-processors) that process personal data on our behalf as part of our services.

We have concluded Data Processing Agreements (DPA) pursuant to GDPR Art. 28 with all listed sub-processors.

AI AI Providers (Artificial Intelligence)

Provider	Purpose	Data Processed	Location	DPA Status	Training
Anthropic PBC San Francisco, USA	EEAT Analyses, SEO Copilot (Primary)	Chat queries Website content	USA	✓ Concluded	Opt-Out
OpenAI LLC San Francisco, USA	AI Analyses (Fallback System)	Chat queries Website content	USA	✓ Concluded	Opt-Out

Training Opt-Out: Training opt-out is activated with both AI providers. Your data is NOT used to train AI models. The retention period is a maximum of 30 days for abuse detection.

€ Payment Processing

Provider	Purpose	Data Processed	Location	DPA Status	Certification
Stripe Inc. Dublin, Ireland (EU)	Payment Processing, Subscriptions	Email Payment data Transactions	EU	✓ Concluded	PCI DSS

🔍 SEO Data APIs

Provider	Purpose	Data Processed	Location	DPA Status	Note
DataForSEO Nicosia, Cyprus (EU)	Keywords, Backlinks, Traffic Data	Domains Keywords	EU	✓ Concluded	No PII

No Personal Data: Only the domains and keywords to be analyzed are transmitted to DataForSEO - no personal user data.

G Google APIs (Optional - only when connected)

Service	Purpose	Data Processed	Location	Legal Basis	Activation
Google Search Console API Google Ireland Ltd.	Search Performance Data, Rankings	Email Properties Search data	EU	Consent (OAuth)	Optional
Google Analytics Data API Google Ireland Ltd.	Website Statistics, GA4 Data	Email Properties Analytics data	EU	Consent (OAuth)	Optional
Google Custom Search API Google Ireland Ltd.	SERP Data, Keyword Rankings	Search queries Domains	EU	Contract Performance	Automatic

Note: The Google Search Console and Analytics integration is completely optional and requires your explicit consent via OAuth 2.0. You can disconnect at any time under Account > Google Connections.

☁ Infrastructure & Hosting

Provider	Purpose	Data Processed	Location	DPA Status	Certification
PythonAnywhere LLP Birmingham, UK	Web Hosting, Database	All user data Logs	UK	✓ Concluded	UK GDPR
IONOS SE Montabaur, Germany	Email Delivery (SMTP)	Email addresses Email content	DE	✓ Concluded	ISO 27001

∑ Summary

Category	Count	EU/EEA	Third Countries	DPA Status
AI Providers	2	0	2 (USA)	All concluded
Payment Processing	1	1 (EU)	0	Concluded
SEO Data APIs	1	1 (EU)	0	Concluded
Google APIs	3	3 (EU)	0	Google ToS
Infrastructure	2	2 (UK/DE)	0	All concluded
Total	9	7	2	100% DPA

Third Country Transfer (USA):

Data transfer to US providers (OpenAI, Anthropic) is based on:

EU-US Data Privacy Framework (Adequacy Decision)
Standard Contractual Clauses (SCC) as additional safeguard
Technical safeguards (encryption, pseudonymization)

📅 Change History

Date	Change	Affected Provider
2026-03-15	Initial publication of sub-processors list	All

You will be notified by email of significant changes to the sub-processors list.

Questions about Sub-processors?

Controller:
Antonio Blago
Email: info@antonioblago.com

Additional Legal Information:
Privacy Policy | Terms of Use | Terms & Conditions | Imprint

Last updated: 2026-03-15 | Antonio Blago - SEO Tools