Sub-processors
Last updated: 11 May 2026
Chut.App BV — BCE/VAT BE 1035.742.145 — Ballingstraat 116, 8560 Wevelgem, Belgium.
Pursuant to Article 28 GDPR and our Data Processing Agreement (DPA), we publish below the complete list of sub-processors we engage to process your personal data.
Current sub-processors
| Sub-processor | Purpose | Data location | Scope |
|---|---|---|---|
| Scaleway S.A.S. R.C.S. Paris 433 115 904 — 8 rue de la Ville l'Évêque, 75008 Paris, France | Cloud infrastructure: compute (Serverless Containers), storage (Object Storage), database (Managed PostgreSQL), network (VPC Private Network), container registry, secrets (encrypted environment variables). | EU — Paris (fr-par) | All |
| OpenAI Ireland Limited EEA/Switzerland controller since 15 February 2024 — Dublin, Ireland | AI processing: tool orchestration, response generation, context analysis. Submitted data is not used to train models. Any onward transfers to OpenAI, L.L.C. (USA) are governed by the European Commission's Standard Contractual Clauses (SCCs). | EU (Ireland) — with SCCs for onward transfers | All |
| Google Ireland Limited Gordon House, Barrow Street, Dublin 4, Ireland | Marketing-site analytics (chut.app) via Google Tag Manager + Google Analytics 4. No application data passes through Google. Analytics cookies are only set after explicit consent (Consent Mode v2). Any onward transfers to Google LLC (USA) are governed by the SCCs. | EU (Ireland) — with SCCs for onward transfers | Marketing site chut.app only |
| UAB iDenfy Baršausko 59, 51423 Kaunas, Lithuania | Identity verification (KYC), AML screening, sanctions / PEP filtering. | EU — Lithuania | Compliance (KYC) |
Sub-processor DPA references
Each sub-processor is covered by a data-processing agreement:
- Scaleway — Data Processing Agreement (June 2024)
- OpenAI Ireland Limited — Data Processing Addendum
- Google Ireland Limited — Google Ads Data Processing Terms + Standard Contractual Clauses
- iDenfy — Privacy Policy & DPA (contact: dpo@idenfy.com)
Change-notification procedure
Pursuant to section 6 of our DPA, the following procedure applies for any sub-processor change:
- Prior notice — account administrators are notified by email at least 30 days before any addition or replacement of a sub-processor
- Objection period — customers have 30 days to raise a reasoned objection by email to dpo@chut.app
- Resolution — Chut.App BV will work to propose an acceptable alternative. If resolution is impossible, the customer may terminate the contract without charge
Change log
| Date | Change |
|---|---|
| 9 May 2026 | Added Google Ireland Limited (Google Tag Manager + Google Analytics 4) for marketing-site analytics on chut.app only. Analytics cookies subject to explicit consent (Consent Mode v2). |
| 23 April 2026 | Post-migration rewrite: Scaleway S.A.S. (infrastructure), OpenAI Ireland Limited (AI) and UAB iDenfy (KYC). The previous cloud sub-processor was decommissioned. |
| 7 February 2026 | Initial publication of the sub-processor list |
Contact
For any question about sub-processors, contact our DPO at dpo@chut.app.