GELIOSSub-processors
Last updated: October 30, 2026
This page lists the third parties ("sub-processors") that Promodo Inc. engages to process personal data on our behalf in connection with the GELIOS service. It is referenced from Section 6 of our Privacy Policy.
We require every sub-processor to provide a level of data protection consistent with our obligations under applicable law, including the EU General Data Protection Regulation (GDPR) and the UK GDPR. Where personal data is transferred outside the EEA or the United Kingdom, we rely on Standard Contractual Clauses or another lawful transfer mechanism as described in Section 10 of the Privacy Policy.
Current sub-processors
| Provider | Purpose | Personal data processed | Provider jurisdiction |
|---|---|---|---|
| Cloud infrastructure provider (identified on request) | Hosting of the infrastructure on which the Service, its database and generated reports run | All Service data at rest | United States — certified under the EU–US Data Privacy Framework |
| Google LLC | Three distinct functions: (a) Gemini API — generating monitoring queries and the Service's analytical features; (b) Google Sign-In — optional OAuth login; (c) Google Analytics 4 — visit, traffic-source, sign-up and payment statistics for the marketing site and the Service | (a) query text and domain names you configure; (b) name, email address, profile image; (c) pages viewed, referring site, browser and device type, IP address (not stored by Google Analytics), a random cookie identifier, our internal numeric account number, and for payments the plan, amount, currency and Stripe payment reference (never name, email address or card details) | United States |
| Resend, Inc. | Delivery of transactional email — account notifications, security alerts and billing messages — from our own domain gelios-monitor.ai | Recipient email address, subject and message content; delivery logs retained by Resend for a limited period | United States |
| OpenAI, LLC | ChatGPT API — backup channel for AI brand visibility checks, used only when the primary way of obtaining answers is unavailable | Query text and domain names you configure in your Project | United States |
| Ahrefs Pte. Ltd. | Brand Radar — AI search query volume and six-month visibility trend data | Domain-level metrics only; no personal data | Singapore |
| Search data provider (identified on request) | Obtaining ChatGPT and Gemini answers from their web interfaces with web search, Google AI Overview results and supplementary search data | Query text, region and domain names under monitoring; no data about your identity is shared | European Economic Area |
| Stripe, Inc. | Payment processing, subscription billing, tax calculation and invoicing for Paid Plans | Name, email address, billing country; card details are collected and stored by Stripe directly and never reach our systems | United States |
| Promodo lead intake service | Receipt and routing of enquiries submitted through the "Contact our team" and "Review Your Case" forms | Name, email address, phone number where provided, domain, enquiry text, the page the form was sent from | Ukraine |
| Pipedrive OÜ | Customer relationship management — storage and handling of sales enquiries received from the lead intake service | Name, email address, phone number where provided, domain, enquiry text, the page the form was sent from | Estonia |
| Microsoft Corporation | Microsoft Clarity — product analytics: recordings of individual interaction sessions and heatmaps for the marketing site and the Service | Interaction behaviour of a visit (pointer movement, clicks, scrolling, pages viewed), IP address and browser user-agent, and data entered into forms on the site, which may include an email address | United States |
| Meta Platforms, Inc. (Meta Platforms Ireland Limited for the EEA, the UK and Switzerland) | Meta Pixel and Meta Conversions API — measuring our advertising on Facebook and Instagram and showing our ads to people who visited gelios-monitor.ai | Pages viewed, plans viewed and chosen with their price, browser and device information, IP address, the _fbp / _fbc cookie identifiers; for payments the plan, amount, currency and Stripe payment reference, and the email address and our internal account number in hashed form (never name, Content, monitored websites or card details) |
United States |
| Telegram FZ-LLC | Internal notification of the Promodo sales team about inactive guest accounts | Email address and monitored domain of the guest account | United Arab Emirates |
We do not sell personal data for money. The only recipient we engage for advertising is Meta, as described in Section 6.4 of the Privacy Policy; you can opt out of it at any time (Section 8.3).
Notes
Cloud infrastructure provider. GDPR Article 13(1)(e) requires disclosure of recipients or categories of recipients, and we disclose this provider as a category. We name the specific provider to customers, auditors and supervisory authorities on request — write to legal@gelios-monitor.ai. The provider is established in the United States and holds a current certification under the EU–US Data Privacy Framework, so transfers to it rely on the European Commission's adequacy decision of 10 July 2023. Until August 2026 the Service was hosted in Ukraine.
Search data provider. As with the cloud infrastructure provider, we disclose it as a category, as GDPR Article 13(1)(e) permits, and name it to customers, auditors and supervisory authorities on request — write to legal@gelios-monitor.ai. It receives only query text, region and domain names, not data about your identity, and it is established in the European Economic Area, so transfers to it stay within the EEA.
Authentication. GELIOS manages user accounts itself using Laravel Fortify. Passwords are stored only as salted hashes and are never transmitted to a third party. Google appears above solely because Google Sign-In is offered as an optional alternative to email-and-password login.
Technical administration. The Service is administered by Promodo personnel, part of whom work from Ukraine. They are not a separate sub-processor — they are our own staff — but their access means personal data stored in the United States can be viewed from Ukraine in the course of deployment, monitoring and incident response. Section 10 of the Privacy Policy describes the safeguards that apply.
Microsoft Clarity. Microsoft states that it acts as an independent controller of the data collected through Clarity, rather than as a processor acting on our behalf. We list it here regardless, because it receives personal data arising from your use of our website and Article 13(1)(e) GDPR requires us to disclose recipients. Clarity is configured to set no cookies at all, so it places nothing in your browser and cannot recognise you on other websites.
Google Analytics. Google processes Google Analytics data on our behalf under Google's data processing terms. We use it on the marketing site and inside the Service, with the cookies described in Section 9 of the Privacy Policy, and for statistics only: we do not use the data for advertising and do not link it to Google Ads.
Meta. Meta processes this data to measure and deliver our ads and also as an independent controller under its own terms; for people in the EEA and the United Kingdom, Promodo Inc. and Meta Platforms Ireland Limited are joint controllers for the collection and transmission of the data. Meta Pixel is not loaded, and payments are not reported to Meta, while you are opted out (Privacy Policy, Section 8.3) or your browser sends the Global Privacy Control signal.
Stripe. Stripe is listed because it is the payment processor for Paid Plans. Until paid subscriptions are launched, no payment data is processed.
Changes to this list
We may add or replace sub-processors as the Service evolves. When we do, we update this page and, where the change materially affects the processing of your personal data, we provide notice in accordance with Section 14 of the Privacy Policy.
Questions
For questions about this list, our sub-processors, or the transfer safeguards that apply to them, contact us at legal@gelios-monitor.ai.