Subprocessors
CobaltAI OÜ (registry code 17561613) uses the third-party providers listed below to operate the cobalt12 service. This page is referenced by our Privacy Policy and Data Processing Addendum.
We give at least 30 days' notice before adding or replacing a sub-processor in Section A. To receive these notices by email, write to [email protected] with the subject "SUBPROCESSOR NOTIFICATIONS".
Section A — Product sub-processors
These providers process customer content (uploaded images, product data, generated output) on our instructions under Article 28 GDPR.
| Provider | Legal entity | Purpose | Data processed | Location |
|---|---|---|---|---|
| Cloudflare | Cloudflare, Inc. | application hosting (Pages, Workers), object storage (R2), database (D1), CDN, security, operational logs | all customer content, account data, technical data | EU / US (global network) |
| OpenAI | OpenAI Ireland Ltd / OpenAI, L.L.C. | AI image generation; listing copy and attribute generation | uploaded images, product data, prompts | EU / US |
Error monitoring currently runs on Cloudflare infrastructure (Workers Logs) and is covered by the Cloudflare entry above.
Section B — Business operations
These providers support billing, communication, and reliability. They do not process customer-uploaded content.
| Provider | Legal entity | Purpose | Data processed | Location |
|---|---|---|---|---|
| Stripe | Stripe Payments Europe, Limited | payment processing, invoicing, tax | billing and transaction data | EU / US |
| Resend | Resend, Inc. | transactional email (account, system, and download-link emails) | email address, name | US |
| Titan | Titan Solution Ltd SEZC | mailbox hosting for support and corporate email | contact details and contents of correspondence you send us | non-EEA (see transfers below) |
Section C — Website analytics and advertising
| Provider | Legal entity | Purpose | Data processed | Location |
|---|---|---|---|---|
| PostHog | PostHog, Inc. | product analytics: pages viewed, actions taken, funnel steps | a pseudonymous visitor identifier, pages and actions, browser and device data, approximate location derived from the IP address; for signed-in accounts, the account identifier only (no name or email address) | United States |
| Meta Pixel | Meta Platforms Ireland Ltd | measuring and delivering our own ads on Facebook and Instagram, only after you accept marketing | a browser identifier, pages viewed, three events (demo started, account created, purchase with its amount), browser and device data, IP address; no name, email or account identifier | Ireland / United States |
| Google Ads | Google Ireland Ltd | measuring and delivering our own ads on Google, only after you accept marketing | a browser identifier and ad-click identifier, the same three events, browser and device data, IP address; no name, email or account identifier | Ireland / United States |
Analytics runs under our Cookie Policy: with your consent where the law requires it, and with an opt-out everywhere. We do not record sessions or screens.
The advertising tags are loaded only after you explicitly accept marketing in the cookie banner, in every country, and never for a browser that sends a Global Privacy Control signal. Withdrawing consent in "Cookie settings" revokes it for both. Meta and Google act as independent controllers for what they do with this data on their own platforms.
Not sub-processors
For clarity, the following are not sub-processors of customer personal data and are listed here only to answer common questions:
- Domain registrar — holds registrant data of CobaltAI OÜ, not customer data.
- Amazon Selling Partner API — when you instruct us to publish a listing, we transmit that content to the marketplace you selected. Amazon is your own service provider under your agreement with Amazon, not our sub-processor.
International transfers
Where a provider is located outside the European Economic Area, transfers are made under an adequacy decision where one applies, or under the European Commission's Standard Contractual Clauses with a transfer risk assessment and supplementary technical measures including encryption in transit and at rest. Details on request to [email protected].
Model training
Our AI providers are engaged on terms that do not permit use of customer content to train their general-purpose models. We do not use customer content to train models.
CobaltAI OÜ · Männimäe/1, Pudisoo küla, Kuusalu vald, Harju maakond 74626, Estonia · [email protected]