Legal

Sub-processor List

Last updated: 2026-06-01. We publish this list in accordance with GDPR Art. 28(2) and our Data Processing Agreement. You will receive at least 30 days’ prior written notice of any changes.

Change notifications: API account holders can subscribe to sub-processor change alerts. Notifications are sent to your account email at least 30 days before any sub-processor is added, replaced, or removed. You may object to a change within 30 days by contacting mailbot@zelixai.ai.

Sub-processorJurisdictionRolePrivacy Policy
Anthropic, Inc.United States (CA)AI model inference — Claude model familyPrivacy policy
OpenAI OpCo, LLCUnited States (CA)AI model inference — GPT model familyPrivacy policy
Google LLCUnited States (CA)AI model inference — Gemini model familyPrivacy policy
Mollie B.V.Netherlands (EU)Payment processing — credit/debit card, bank transferPrivacy policy
WorldStream B.V.Netherlands (EU)Bare-metal server hosting (dev01-aionized, Rotterdam DC)Privacy policy
HashiCorp, Inc.United States (CA)Vault software license (OSS) — used on-premises; no data sent to HashiCorpPrivacy policy

Cross-border transfers

Anthropic, OpenAI, and Google are based in the United States. When we route prompts to these providers, we transfer personal data to third countries within the meaning of GDPR Chapter V. This transfer is lawful on the basis of Standard Contractual Clauses (SCC) Module 3 (Processor → Sub-processor), supplemented by encryption in transit (TLS 1.3) and in-platform (Vault transit). See the DPA Section 7 for full details.

Notification procedure

When Tokonomix intends to add, replace, or remove a sub-processor, we will:

  1. Update this page with the proposed change, marked as “Pending (effective >30 days)”.
  2. Send an email notification to all active API account holders at least 30 days before the change takes effect.
  3. Accept written objections at mailbot@zelixai.ai within the notice period.
  4. Update this page once the change is live.