Legal

Sub-processor List

Last updated: 2026-10-03. We publish this list in accordance with GDPR Art. 28(2) and our Data Processing Agreement. You will receive at least 30 days’ prior written notice of any changes.

Change notifications: API account holders can subscribe to sub-processor change alerts. Notifications are sent to your account email at least 30 days before any sub-processor is added, replaced, or removed. You may object to a change within 30 days by contacting mailbot@zelixai.ai.

Sub-processorJurisdictionRolePrivacy Policy
Stripe Payments Europe, Ltd.Ireland (EU)Payment processing — card paymentsPrivacy policy
Pay.nlNetherlands (EU)Payment processing — iDEAL and SEPAPrivacy policy
Anthropic, PBCUnited StatesAI model inference — Claude modelsPrivacy policy
OpenAI OpCo, LLCUnited StatesAI model inference — GPT and GPT Image modelsPrivacy policy
Google LLCUnited StatesAI model inference — Gemini modelsPrivacy policy
Microsoft (Azure)Sweden (EU)AI model inference — OpenAI models hosted in the EU; safety check of prompts, of images (generated, or uploaded for editing) and video frames, and of speech in generated videos (Azure AI Content Safety)Privacy policy
OVH Groupe SAS (OVHcloud)France (EU)AI model inference — open models hosted in the EU; safety check of prompts, of images (generated, or uploaded for editing) and video frames, and of speech in generated videos; EU object storage for uploaded files and generated videosPrivacy policy
Black Forest LabsGermany (EU)AI model inference — FLUX image modelsPrivacy policy
OpenRouter, Inc.United StatesAI model routing to further model providersPrivacy policy
xAIUnited StatesAI model inference — Grok modelsPrivacy policy
fal.aiUnited StatesAI model inference — image and video modelsPrivacy policy
Hugging Face, Inc.United StatesAI model inference — open models via the inference routerPrivacy policy
Z.ai (Zhipu AI)ChinaAI model inference — GLM text, image, video and speech modelsPrivacy policy
Alibaba Cloud (DashScope International)SingaporeAI model inference — Qwen modelsPrivacy policy
WorldStream B.V.Netherlands (EU)Bare-metal server hostingPrivacy policy
Cloudflare, Inc.United StatesTurnstile bot check on sign-up, sign-in and public demosPrivacy policy

Cross-border transfers

Several sub-processors are located outside the EEA: in the United States (Anthropic, OpenAI, Google, OpenRouter, xAI, fal.ai, Hugging Face, Cloudflare), in China (Z.ai) and in Singapore (Alibaba Cloud). Such transfers rely on the Standard Contractual Clauses (Commission Decision (EU) 2021/914), supplemented by encryption in transit. See the DPA Section 7 for full details.

Notification procedure

When Tokonomix intends to add, replace, or remove a sub-processor, we will:

  1. Update this page with the proposed change, marked as “Pending (effective >30 days)”.
  2. Send an email notification to all active API account holders at least 30 days before the change takes effect.
  3. Accept written objections at mailbot@zelixai.ai within the notice period.
  4. Update this page once the change is live.