Sub-processors
Last updated: October 20, 2026
In accordance with GDPR Article 28, One Labs Bot Technologies Limited uses the following sub-processors to provide the platform. Each sub-processor processes personal data only to the extent necessary for the purposes described below.
This page separates two things:
- Platform sub-processors — providers the platform itself uses to run your bot (hosting, AI processing, payments) and our website (cookie consent, statistics).
- Skills & channels — optional capabilities and messengers you add to your bot. They connect to their own third-party providers, which are disclosed with each skill, much like apps in an app store. See Skills & Channels You Install.
We will update this page when sub-processors are added or changed. Material changes will be communicated to registered users via email.
Infrastructure & Hosting
| Sub-Processor | Location | Purpose | Data Categories | Data Retention |
|---|---|---|---|---|
| Hetzner Online GmbH | Nuremberg, Germany (EU) | Platform hosting, data storage, server infrastructure | Account data, bot data (messages, memory, settings), technical data (IP, device info), usage metadata | Duration of service |
AI Platform Providers
When you create a bot, an EU-hosted model from Lyceum is preselected; in the bot’s advanced settings you can choose a model via OpenRouter instead.
| Sub-Processor | Location | Purpose | Data Categories | Data Retention |
|---|---|---|---|---|
| Lyceum Technology Germany GmbH | European Union (company seat: Berlin, Germany) | EU-hosted AI models — processes your bot’s conversations when you choose a Lyceum model. The only AI provider allowed in strict GDPR mode. | Prompt/response content, request metadata (model, token counts) | Per Lyceum’s data processing terms |
| OpenRouter, Inc. | USA | AI model routing layer — routes requests to the model provider you selected (e.g. Anthropic, OpenAI, Google, Mistral) when you choose an OpenRouter model. Outside strict GDPR mode it can also be used for image analysis, background summaries and skills that make their own AI call, even if your bot runs a Lyceum model. | Prompt/response content (transient), request metadata (model selection, token counts) | Metadata only (no prompt/response storage by default); the selected model provider’s retention applies (see Privacy Policy, section 5) |
Payment Processing
| Sub-Processor | Location | Purpose | Data Categories | Data Retention |
|---|---|---|---|---|
| Stripe, Inc. | USA | Payment processing, invoicing | Name, email, billing address, payment method details, transaction history | Per Stripe’s data retention policy; financial records as required by law |
Website: Cookie Consent & Statistics
These providers are used on our website only. Google Analytics runs only if you consent to statistics cookies; you can change your choice at any time through “Cookie Settings” at the foot of every page. Details are in our Cookie Policy.
| Sub-Processor | Location | Purpose | Data Categories | Data Retention |
|---|---|---|---|---|
| Cookiebot (Usercentrics A/S) | Denmark (EU) | Asks for and records your cookie choice | Your consent choice, consent ID, shortened IP address, browser data, date and time of the choice | Per Cookiebot’s data processing terms |
| Google Ireland Limited (Google Analytics) | Ireland (EU) | Visitor statistics for our website, only with your consent to statistics cookies | Shortened IP address, browser and device data, pages visited and interactions | Per our Google Analytics data retention settings |
Skills & Channels You Install
Skills add capabilities to your bot (e.g. Google Calendar, voice, image generation); channels connect it to messengers. Each skill and channel connects to its own third-party provider, which is shown in the skill’s description before you install it. These providers only receive data while the skill or channel is installed, and you can remove them at any time.
A few skills and channels come pre-installed on every new bot. You can remove each of them. All pre-installed skills and channels are classified as GDPR-safe and stay available in strict GDPR mode. Any other skill you install yourself.
| Skill / Channel | Provider | Location | Data Shared |
|---|---|---|---|
| Web search | Brave Search (Brave Software, Inc.) | USA (EU-US Data Privacy Framework) | Search queries |
| WhatsApp (Meta) | Per WhatsApp’s terms | Messages exchanged with your bot via WhatsApp | |
| Telegram | Telegram | Per Telegram’s terms | Messages exchanged with your bot via Telegram |
If you connect your own API key for an AI provider, your requests go directly to that provider under its own terms.
Strict GDPR Mode
Strict GDPR mode is an opt-in setting per bot and offers a fully GDPR-ready path:
- Only EU-hosted AI models (Lyceum) are used — including for image analysis and background summaries.
- Only skills and channels classified as GDPR-safe can be installed; switching the mode on removes all others.
- Web search uses Brave Search. Only the search query itself is sent to Brave Search (USA), not your conversation. Brave Software, Inc. is certified under the EU-US Data Privacy Framework.
Transfer Mechanisms
Where personal data is transferred to sub-processors located outside the European Economic Area (EEA), such transfers are protected by:
- Standard Contractual Clauses (SCCs) adopted by the European Commission pursuant to GDPR Article 46(2)(c)
- Adequacy decisions where applicable, including the EU-US Data Privacy Framework for certified US providers (e.g. Brave Search) and the UK adequacy decision
- Additional technical and organisational safeguards, including encryption in transit and at rest
No data is transferred to a third country without an appropriate transfer mechanism in place.
Contact
One Labs Bot Technologies Limited
Company number (CRO): 817724
Unit 2, 2 Bridge Street
Athlone, Co. Westmeath, N37 F1W4, Ireland
Email: support@onebuddy.app