1. What a subprocessor is
A workspace using Telesuber is the controller of its subscribers' personal data, and we process that data on its behalf. Where we in turn rely on another company to provide part of the service — somewhere to run the software, something to send email with — that company is a subprocessor, and the data protection law that governs our relationship with our customers governs ours with them.
The categories below are all it takes to run this product: infrastructure to host the application and its database, and delivery services for the messages the platform itself sends. We deliberately keep the list short, because every name on it is another company holding somebody's data.
2. How we choose them
Before a provider is added we consider what it actually needs to see, where it processes data, and what it commits to contractually. Each one is engaged under a written contract that imposes data protection obligations materially no less protective than those we owe our own customers, so far as they apply to what that provider does.
We remain fully responsible to our customers for the performance of every subprocessor on this list. If one of them causes a problem, it is ours to answer for. We do not claim any security certification on their behalf, and we do not publish third-party audit reports.
3. Providers used only for some features
Not every provider is involved in every workspace. Some are used only when a particular feature is switched on, so a workspace that never turns that feature on never sends data to that provider. The When used column says which is which: "Always" means every workspace, and anything else names the condition that brings the provider into play.
4. Who is not on this list
Three relationships belong to the workspace rather than to us. They are not our subprocessors, and they are not listed below:
- The payment provider a workspace connects. Subscriber payments go directly into the workspace's own payment account. We never receive or hold that money, and the provider processes that payment data under its own agreement with the workspace, not with us.
- The AI provider a workspace chooses. Where a workspace switches on the AI support bot using its own API key, the messages sent for answering go to the provider it has chosen, under its own account and terms with that provider.
- Telegram. The whole point of the product is to operate the workspace's own Telegram bot, so messages, invite links and channel membership changes are delivered through Telegram under Telegram's terms. The bot, the channels and the relationship with Telegram are the workspace's own.
Those three are described in more detail in section 8.5 of the Data Processing Addendum, and what each of them means for personal data is covered in the Privacy Policy.
5. The current list
This is the complete list of subprocessors engaged by Telesuber as at the date at the top of this page.
| Provider | What they do | Data involved | Where | When used |
|---|---|---|---|---|
| Hosting provider | Runs the servers and the database behind the service | Everything stored in the service | — | Always |
| Resend | Delivers the emails we send: sign-up codes, password resets, team invitations, receipts and product news | The recipient's email address, the subject and the contents of the message | United States | Always |
| Stripe, PayPal | Take payment for your own plan with us and handle its renewals | Your email address, the plan and the amount. A card is typed into the provider's own fields — on its own page, or in Stripe's own card fields on the card step of our checkout — and never reaches us. On that card step Stripe's script also looks at the browser and the device and sets Stripe's fraud-prevention cookies (see the Cookie Policy) | United States, Ireland, Luxembourg | When you pay for a plan |
| Stripe, PayPal, Skrill (Paysafe), NOWPayments, OKX | Take your subscribers' payments into your own account, under your own agreement with them | A buyer's email where they give one, the plan name, the amount and our reference ids. OKX is different: it is your own exchange account, read with a key that can only read — a buyer sends USDT to your deposit address and nothing about them is sent to OKX by us; a transaction id a buyer pastes is looked up there | As set out in your own agreement with them | When you connect one to your workspace |
| Telegram | Delivers your bot's messages and opens and closes channel access | Telegram user ids and the messages your bot sends and receives | Telegram FZ-LLC, Dubai, United Arab Emirates | Always |
| Groq, Anthropic | Answer subscribers through a workspace's AI support bot, and power our help assistant when it is on | The knowledge the workspace wrote, the last few messages of the conversation and the new question. No names, Telegram ids or email addresses | United States | Only when a workspace switches its AI bot on with its own key, or when our help assistant is on |
6. Where data is processed
The Where column says where each provider processes data. Some processing may take place outside the European Economic Area and the United Kingdom, including in the United States.
Where a transfer of that kind needs a safeguard under the EU or UK GDPR, it is made under an adequacy decision where one covers the destination, and otherwise under the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum. Section 13 of the Data Processing Addendum sets out how those clauses apply and how they are completed.
7. Changes and notice
We give notice before adding a subprocessor or replacing an existing one. Notice is given in two ways at once:
- by updating this page, which carries the date it last changed at the top; and
- by emailing customers who have asked to be notified of changes.
We give that notice at least 15 days before the change takes effect, where that is practicable. Occasionally it will not be — a provider that fails, or a change made to deal with a security problem, has to be replaced when it happens — and in that case we give notice as soon as we can.
To be added to the notification list, write to us using the details in section 9 and ask.
8. How to object
A customer may object to a new subprocessor on reasonable data protection grounds by writing to us within the notice period. We will work with you in good faith to address the objection — usually by explaining the safeguards in place, and where an alternative arrangement exists, by offering it.
If we cannot address the objection within a reasonable time, you may terminate the part of the service that requires that subprocessor, and where that is the service as a whole, the agreement, by writing to us. Section 8.4 of the Data Processing Addendum is the governing wording.
An objection is about data protection, not preference. Telling us why a provider is a problem for you — where it processes data, or a decision your own regulator has made — is what lets us do something useful about it.
9. Contact
Questions about this list, requests to be notified of changes, and objections go to Telesuber:
- Email: no-reply@telesuber.com
- The help chat inside your dashboard, which reaches the same people
Related documents: the Data Processing Addendum, the Privacy Policy, the Cookie Policy and the legal index.