The third parties we rely on to deliver the Service, what they do, and where your data goes.
FunctionalAI engages a limited number of trusted third-party companies ("sub-processors") to help us provide, secure, and improve the Service. This page is maintained in accordance with our Terms and Conditions, our Privacy Policy, and the Data Processing Addendum incorporated therein, and is provided to comply with our obligations under GDPR Article 28 and equivalent laws.
Each sub-processor is bound by written terms imposing data-protection obligations substantially similar to those we accept with you. Where personal data of EEA, UK, or Swiss data subjects is transferred outside those territories, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, the Swiss FDPIC adaptations, and/or EU–U.S. Data Privacy Framework certifications as applicable.
| Sub-Processor | Purpose | Data Categories | Location |
|---|---|---|---|
| OpenAI, L.L.C. | Large language model inference (chatbot responses, embeddings, AI-driven features) and abuse monitoring. | Prompts, conversation content, knowledge-base content, files submitted to AI features. | United States (with EU data residency where offered by the API). |
| Amazon Web Services EMEA SARL ("AWS") | Cloud hosting, application compute, databases, object storage, backups, and supporting infrastructure. | All Service data at rest and in transit, including account data, knowledge bases, conversation logs, and operational logs. | European Union — Frankfurt (eu-central-1). |
| Stripe, Inc. / Stripe Payments Europe, Ltd. | Payment processing for subscriptions and usage-based fees. | Billing name, billing email, billing address, payment method details (collected and stored by Stripe directly), transaction history. | United States and Ireland. |
| Lemon Squeezy (LMSQUEEZY, LLC) | Merchant-of-record payment processing, invoicing, sales-tax handling, and subscription management. | Billing name, billing email, billing address, payment method details (collected and stored by Lemon Squeezy directly), transaction history. | United States. |
| Meta Platforms, Inc. (Messenger / Instagram / WhatsApp Business APIs) | Delivery and receipt of messages on Meta channels you have explicitly connected to your account. | Messages, message metadata, sender/recipient identifiers, and any attachments transmitted through the connected channel. | United States and EU (per Meta data-transfer practices). |
| Google LLC (Gmail API) | Reading, drafting, and sending email on Google accounts you have explicitly connected to your account. | Email content, email headers, attachments, and account identifiers from connected Gmail accounts. | United States and global Google infrastructure. |
| Shopify Inc. | Store, product, customer, and order data integration for merchants who have installed the FunctionalAI Shopify app. | Store metadata, product catalogue, order data, and customer data made available through the Shopify Admin API. | Canada, United States, and EU per Shopify data-residency practices. |
| PostHog Inc. | Product analytics for the marketing site and the application — usage patterns, feature adoption, and session insights used to improve the product. | Account identifier, IP address, browser/device information, pages viewed, feature interactions, and session metadata. | United States (PostHog US Cloud). |
| Google Analytics (Google LLC / Google Ireland Ltd.) | Aggregated website analytics for the FunctionalAI marketing site and the Shopify app listing (not the application). | IP address (truncated), browser type, device type, pages viewed, referring URL. | United States (with Google Ireland Ltd. as EU contracting entity). |
Several of the sub-processors above (including Meta Platforms, Google, and Shopify) only receive your data if you explicitly connect the corresponding integration in the application. If you do not connect a channel, we do not transmit data to that provider on your behalf. You may disconnect any integration at any time from your account settings; once disconnected, we will stop transmitting new data to that provider.
We will provide at least thirty (30) days' notice before engaging a new sub-processor that processes personal data, or before replacing an existing one. Notice will be given by updating this page and (where you have subscribed to such notifications) by email to the address associated with your account. To subscribe to email notifications, send a request to privacy@functional-ai.com with the subject line "Subscribe: Sub-Processor Updates."
If you reasonably object to a new sub-processor on documented data-protection grounds, please contact us at privacy@functional-ai.com within 30 days of the notice. We will work with you in good faith to find a resolution. If no resolution can be reached, you may terminate the affected portion of the Service for convenience and receive a pro-rata refund of any prepaid, unused fees, as set out in our Terms.
In addition to the third-party sub-processors listed above, FunctionalAI may share data with its own personnel and contractors who are bound by written confidentiality and data-protection obligations and who require access to provide, support, or secure the Service.
If you have any questions about this Sub-Processors page, our processing activities, or your rights, please contact us:
FunctionalAI Privacy Team
Privacy / Sub-Processor Requests:privacy@functional-ai.com
Legal Matters:legal@functional-ai.com