Sub-processor / DPA disclosure

If you're the data controller for your end users and you've signed (or need to sign) data processing agreements with your own customers, you likely need to list ARCY AI as a sub-processor, along with ARCY AI's own sub-processors.

What to paste

Sub-processor: ARCY AI

Purpose: In-product user guidance, assistance, and behavioral analytics
within [Your Product Name].

Data processed: Session and interaction data described in our Privacy
Policy's "Third-Party Product Assistance" section, and any account
identifiers or attributes we choose to share with ARCY AI.

Location of processing: ARCY AI's core infrastructure runs on Amazon Web
Services. [CONFIRM CURRENT AWS REGION(S) WITH ARCY AI BEFORE RELYING ON THIS
FOR A REGULATED CUSTOMER RELATIONSHIP. DATA-RESIDENCY AND REGION COMMITMENTS
ARE NOT YET FINALIZED, SEE BELOW.]

ARCY AI's own sub-processors (as of this writing):

| Provider | Purpose |
|---|---|
| Amazon Web Services (AWS) | Hosting, database, and AI inference |
| Clerk | Authentication and session management |
| Resend | Transactional email |
| Stripe | Billing (only if you connect Stripe billing) |

ARCY AI does not sell or share sub-processor data with third parties for
their own purposes. For ARCY AI's current, authoritative sub-processor list,
see https://docs.arcyai.com/compliance/sub-processors. To request ARCY AI's
Data Processing Agreement or security questionnaire, contact
contact@arcyai.com.

Notes on filling this in

• Confirm the AWS region(s) with ARCY AI directly before naming one in your own DPA. This template deliberately doesn't assert a specific region or jurisdiction (for example "hosted in the EU"), since that's a data-residency commitment, not a hosting-provider fact, and asserting the wrong one in a signed customer contract is a real liability.
• Don't hardcode ARCY AI's sub-processor table into a document you don't intend to keep updated. Consider linking to Sub-processors instead of copying the table, so it stays current if ARCY AI adds or removes a provider.
• ARCY AI's GDPR posture is "in progress," not certified, as tracked honestly on Certification status. If your own DPA requires you to represent your sub-processors' certification status, reflect that accurately rather than assuming completion.
• A signed DPA with ARCY AI is available on request via Data processing agreements. If you're in a regulated industry (HealthTech, FinTech, government), request it and confirm terms before relying on this disclosure for a customer contract.