Sub-processors

Introduction

Chatty is live chat, AI chatbot, help center, and customer support software for Shopify merchants, operated by AVADA GROUP COMPANY LIMITED (CÔNG TY TNHH AVADA GROUP), Business Registration No. 0109524114, registered at 102 Tran Phu, Ha Dong, Hanoi, Vietnam.

For the personal data of a merchant’s end customers, the merchant is the controller and Chatty is the processor. The companies listed on this page are the sub-processorswe engage to deliver the Services on the merchant’s documented instructions. We engage each of them under its published data processing terms, which carry confidentiality and data protection obligations, and we rely on the transfer mechanism named in the table for any data that leaves the EEA, the UK or Switzerland.

Shopify is not a sub-processor of Chatty.Shopify is the merchant’s own commerce platform and billing provider, and the merchant’s relationship with Shopify is direct and governed by Shopify’s own terms and privacy policy.

This page is the list we commit to keeping current in our Data Processing Agreement. It is the place to check before and after any change. For the wider picture, see our Privacy Policy.

Current Sub-processors

All transfers of personal data out of the European Economic Area, the United Kingdom, and Switzerland to these companies rely on the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, supplemented by the UK International Data Transfer Addendum version B.1.0 for United Kingdom transfers, and by the adaptations required by the Swiss Federal Act on Data Protection for Swiss transfers.

One exception, stated plainly. Those clauses cover transfers to the United States. They do not cover the transfer to DeepSeek in China, and we are not going to name a mechanism we cannot produce on request. We are settling that paperwork now and will publish it here, with the date, as soon as it is signed. In the meantime, merchants who do not want any processing outside the United States can ask us at [email protected] to keep their store off the DeepSeek routing.

Infrastructure Locations

Every server and store that holds data runs in the United States. Real-time chat delivery runs on a global edge network, with the data itself stored in the United States. The table below shows where each part of the platform lives. The AI providers in the table above are services we call, not infrastructure we run; one of them, DeepSeek, answers from China.

Our personnel in Vietnam access these systems remotely to operate and support the Services, under access controls and least-privilege permissions. No customer data is stored in Vietnam.

AI Sub-processors

Four of the sub-processors above handle AI workloads. Google LLCprovides the Gemini API, which generates answers from the merchant’s configured knowledge sources. OpenAI, L.L.C. provides content moderation and embeddings. Anthropic PBC answers in the product demo on this website and helps build the store knowledge memory. DeepSeek generates answers for selected stores and also helps build the store knowledge memory. To produce an answer, the relevant conversation content and knowledge sources are sent to the provider handling that store over an encrypted connection.

Google, OpenAI and Anthropic process this data in the United States. DeepSeek processes it in China.

Under the API terms of Google and OpenAI, data submitted through the API is not used to train their models. We have not verified an equivalent term for Anthropic or DeepSeek and will not claim one until we can produce it on request. Merchants who want no processing outside the United States, or off the DeepSeek route, can write to [email protected]. The four providers named here are the only AI providers Chatty sends customer data to.

For how we meet AI transparency and governance obligations, see our AI compliance page.

How We Select and Monitor Sub-processors

Before we engage a sub-processor we look at three things:

• Third-party certification. Whether the vendor holds an independent security certification or attestation.
• Data processing agreement. Whether the vendor will sign a DPA that binds it to obligations at least as protective as ours.
• Transfer safeguards. Whether the vendor will sign the Standard Contractual Clauses for transfers out of the EEA, the United Kingdom, and Switzerland.

For every vendor above we rely on whatever security documentation and certifications that vendor publishes; the larger ones publish a good deal, the smaller ones less. Any certification named on a vendor’s own trust page belongs to that vendor, not to us. Chatty itself holds no SOC 2 or ISO/IEC 27001 certification.

To be straight about our limits: we do not currently run a periodic reassessment of our sub-processors using our own security questionnaire. We review a vendor when we engage it, when its terms change, and when an incident or a merchant question prompts us to.

Notice of Changes

Before we add or replace a sub-processor, we give merchants at least 30 days’ written notice.

During that period a merchant may object on reasonable grounds relating to data protection. We work with the merchant to address the objection, for example by offering a configuration change or an alternative. If we cannot resolve it within 30 days, the merchant may terminate the affected part of the Services and receive a pro-rata refund of any fees paid in advance for the unused period.

To subscribe to change notices, email [email protected] with the subject line “Sub-processor notifications” and the store domain and email address that should receive them. We add you to the notification list and confirm by email.

Data Processing Agreement

Merchants can request a countersigned Data Processing Agreement by emailing [email protected].

The DPA is built on Article 28 of the GDPR and incorporates the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 and the UK International Data Transfer Addendum version B.1.0. It has been in effect since 1 January 2026 and covers processing instructions, confidentiality, security measures, sub-processor terms, assistance with data subject requests, breach notification, and deletion or return of data at the end of the contract.

Contact

AVADA GROUP COMPANY LIMITED (CÔNG TY TNHH AVADA GROUP)
Business Registration No. 0109524114
102 Tran Phu, Ha Dong, Hanoi, Vietnam

For any question about this list, a DPA, or personal data, email [email protected]. See also our Privacy Policy.