Subprocessors · SmartDuke

Current subprocessors

Contabo GmbH

What it does: Hosting: the servers that run SmartDuke, file storage and backups
Data: All data stored in SmartDuke
Where: Germany (European Union)
When: Always

OpenAI

What it does: AI models behind Duke, the assistant, and document search
Data: The question or task and the records Duke needs to answer it
Where: United States
When: When Duke or AI search is used on SmartDuke's AI credits

Anthropic

What it does: AI models, only for a business that connects its own Anthropic key
Data: The question or task and the records Duke needs to answer it
Where: United States
When: Only if the business chooses it, under the business's own Anthropic account

Google (Google Analytics)

What it does: Counting visits to smartduke.com (not the SmartDuke app)
Data: Pages viewed, approximate location, device and browser, and how the visitor arrived
Where: United States and other Google locations
When: When someone visits smartduke.com (in Europe, only after they allow it)

Resend

What it does: Sending email: sign-in codes, invitations, invoices and the business's own emails
Data: Recipient address, sender name, subject and message
Where: United States
When: Whenever an email is sent

Meta Platforms (WhatsApp Cloud API)

What it does: Sending and receiving WhatsApp messages for a business that connects its number
Data: Phone numbers, names and message content
Where: United States and other Meta locations
When: Only if the business connects WhatsApp

PayU

What it does: Collecting SmartDuke subscription payments in India
Data: Billing name, email, phone, amount and payment status (card and bank details are entered with PayU, not with us)
Where: India
When: When a business in India pays SmartDuke

PayPal

What it does: Collecting SmartDuke subscription payments outside India
Data: Billing name, email, amount and payment status (card details are entered with PayPal, not with us)
Where: United States and other PayPal locations
When: When a business outside India pays SmartDuke

Not on this list

Virus scanning of uploaded files runs on our own servers, so no file leaves SmartDuke for it. Services a business connects itself, such as its own WhatsApp number, its own Stripe, PayPal, Razorpay or PayU account for its customers' payments, or its own AI key, work under the business's own agreement with them.

We tell account owners by email at least 30 days before adding or replacing a subprocessor, as set out in our Data Processing Agreement.

Who helps us run SmartDuke.