Sub-processors
Last updated: 27 June 2026
Chut.App BV — BCE/VAT BE 1035.742.145 — Ballingstraat 116, 8560 Wevelgem, Belgium.
Pursuant to Article 28 GDPR and our Data Processing Agreement (DPA), we publish below the complete list of sub-processors we engage to process your personal data.
Current sub-processors
Personal data is anonymised before any AI processing. Because anonymised data is no longer personal data, AI model providers do not act as sub-processors and are not listed below.
| Sub-processor | Purpose | Data location | Scope |
|---|---|---|---|
| Scaleway S.A.S. R.C.S. Paris 433 115 904 — 8 rue de la Ville l'Évêque, 75008 Paris, France | Cloud infrastructure: compute (Serverless Containers), storage (Object Storage), database (Managed PostgreSQL), network (VPC Private Network), container registry, secrets (encrypted environment variables). | EU — Paris (fr-par) | All |
| Google Ireland Limited Gordon House, Barrow Street, Dublin 4, Ireland | Marketing-site analytics (chut.app) via Google Tag Manager + Google Analytics 4. No application data passes through Google. Analytics cookies are only set after explicit consent (Consent Mode v2). Any onward transfers to Google LLC (USA) are governed by the SCCs. | EU (Ireland) — with SCCs for onward transfers | Marketing site chut.app only |
| TrustMe To be confirmed | Identity verification (KYC), AML screening, sanctions / PEP filtering. | To be confirmed | Compliance (KYC) |
| Brevo (Sendinblue SAS) 106 boulevard Haussmann, 75008 Paris, France | Waitlist / lead capture and the confirmation email sent when you submit a form on chut.app (name, email, company). No application data passes through Brevo. | EU — France | Marketing site chut.app only |
Sub-processor DPA references
Each sub-processor is covered by a data-processing agreement:
- Scaleway — Data Processing Agreement (June 2024)
- Google Ireland Limited — Google Ads Data Processing Terms + Standard Contractual Clauses
- TrustMe — DPA / privacy policy (to be confirmed)
- Brevo (Sendinblue SAS) — Terms & Data Processing Agreement
Change-notification procedure
Pursuant to section 6 of our DPA, the following procedure applies for any sub-processor change:
- Prior notice — account administrators are notified by email at least 30 days before any addition or replacement of a sub-processor
- Objection period — customers have 30 days to raise a reasoned objection by email to dpo@chut.app
- Resolution — Chut.App BV will work to propose an acceptable alternative. If resolution is impossible, the customer may terminate the contract without charge
Change log
| Date | Change |
|---|---|
| 27 June 2026 | Removed OpenAI Ireland Limited, Anthropic, PBC and DeepSeek: personal data is anonymised before any AI processing, so AI providers no longer process personal data and are not sub-processors. Added Brevo (Sendinblue SAS) for waitlist / lead capture. All listed sub-processors are EU-established. Replaced the identity-verification (KYC) sub-processor: TrustMe in place of UAB iDenfy. |
| 9 May 2026 | Added Google Ireland Limited (Google Tag Manager + Google Analytics 4) for marketing-site analytics on chut.app only. Analytics cookies subject to explicit consent (Consent Mode v2). |
| 23 April 2026 | Post-migration rewrite: Scaleway S.A.S. (infrastructure), OpenAI Ireland Limited (AI) and UAB iDenfy (KYC). The previous cloud sub-processor was decommissioned. |
| 7 February 2026 | Initial publication of the sub-processor list |
Contact
For any question about sub-processors, contact our DPO at dpo@chut.app.