GELIOSSub-processors
Last updated: September 4, 2026
This page lists the third parties ("sub-processors") that Promodo Inc. engages to process personal data on our behalf in connection with the GELIOS service. It is referenced from Section 6 of our Privacy Policy.
We require every sub-processor to provide a level of data protection consistent with our obligations under applicable law, including the EU General Data Protection Regulation (GDPR) and the UK GDPR. Where personal data is transferred outside the EEA or the United Kingdom, we rely on Standard Contractual Clauses or another lawful transfer mechanism as described in Section 10 of the Privacy Policy.
Current sub-processors
| Provider | Purpose | Personal data processed | Provider jurisdiction |
|---|---|---|---|
| Cloud infrastructure provider (identified on request) | Hosting of the infrastructure on which the Service, its database and generated reports run | All Service data at rest | United States — certified under the EU–US Data Privacy Framework |
| Google LLC | Three distinct functions: (a) Gemini API — execution of AI brand visibility checks; (b) Google Sign-In — optional OAuth login; (c) Google Analytics 4 — visit and traffic-source statistics for the marketing site | (a) query text and domain names you configure; (b) name, email address, profile image; (c) pages viewed, referring site, browser and device type, IP address (not stored by Google Analytics) and a random cookie identifier | United States |
| Resend, Inc. | Delivery of transactional email — account notifications, security alerts and billing messages — from our own domain gelios-monitor.ai | Recipient email address, subject and message content; delivery logs retained by Resend for a limited period | United States |
| OpenAI, LLC | ChatGPT API — execution of AI brand visibility checks | Query text and domain names you configure in your Project | United States |
| Ahrefs Pte. Ltd. | Brand Radar — AI search query volume and six-month visibility trend data | Domain-level metrics only; no personal data | Singapore |
| DataForSEO OÜ | Supplementary search data and Google AI Overview results | Query text and domain names under monitoring | Estonia |
| Stripe, Inc. | Payment processing, subscription billing, tax calculation and invoicing for Paid Plans | Name, email address, billing country; card details are collected and stored by Stripe directly and never reach our systems | United States |
| Promodo lead intake service | Receipt and routing of enquiries submitted through the "Contact our team" form | Name, email address, phone number where provided, domain, enquiry text | Ukraine |
| Pipedrive OÜ | Customer relationship management — storage and handling of sales enquiries received from the lead intake service | Name, email address, phone number where provided, domain, enquiry text | Estonia |
| Microsoft Corporation | Microsoft Clarity — product analytics: recordings of individual interaction sessions and heatmaps for the marketing site and the Service | Interaction behaviour of a visit (pointer movement, clicks, scrolling, pages viewed), IP address and browser user-agent, and data entered into forms on the site, which may include an email address | United States |
| Telegram FZ-LLC | Internal notification of the Promodo sales team about inactive guest accounts | Email address and monitored domain of the guest account | United Arab Emirates |
We do not sell personal data, and we do not engage sub-processors for advertising or cross-context behavioural profiling.
Notes
Cloud infrastructure provider. GDPR Article 13(1)(e) requires disclosure of recipients or categories of recipients, and we disclose this provider as a category. We name the specific provider to customers, auditors and supervisory authorities on request — write to legal@gelios-monitor.ai. The provider is established in the United States and holds a current certification under the EU–US Data Privacy Framework, so transfers to it rely on the European Commission's adequacy decision of 10 July 2023. Until August 2026 the Service was hosted in Ukraine.
Authentication. GELIOS manages user accounts itself using Laravel Fortify. Passwords are stored only as salted hashes and are never transmitted to a third party. Google appears above solely because Google Sign-In is offered as an optional alternative to email-and-password login.
Technical administration. The Service is administered by Promodo personnel, part of whom work from Ukraine. They are not a separate sub-processor — they are our own staff — but their access means personal data stored in the United States can be viewed from Ukraine in the course of deployment, monitoring and incident response. Section 10 of the Privacy Policy describes the safeguards that apply.
Microsoft Clarity. Microsoft states that it acts as an independent controller of the data collected through Clarity, rather than as a processor acting on our behalf. We list it here regardless, because it receives personal data arising from your use of our website and Article 13(1)(e) GDPR requires us to disclose recipients. Clarity is configured to set no cookies at all, so it places nothing in your browser and cannot recognise you on other websites.
Google Analytics. Google processes Google Analytics data on our behalf under Google's data processing terms. We use it on the marketing site only, with the cookies described in Section 9 of the Privacy Policy, and for statistics only: we do not use the data for advertising and do not link it to Google Ads.
Stripe. Stripe is listed because it is the payment processor for Paid Plans. Until paid subscriptions are launched, no payment data is processed.
Changes to this list
We may add or replace sub-processors as the Service evolves. When we do, we update this page and, where the change materially affects the processing of your personal data, we provide notice in accordance with Section 14 of the Privacy Policy.
Questions
For questions about this list, our sub-processors, or the transfer safeguards that apply to them, contact us at legal@gelios-monitor.ai.