Sub-processors and recipients
Last updated: 2026-08-16
Get Orion AI AB uses the service providers listed below to operate the oriiion service. This page is referred to by our privacy policy and forms part of our data processing agreement. It is the authoritative list.
Where we engage a new provider that will process personal data, we update this page before the provider begins processing. Customers who have entered into our data processing agreement may object to a new sub-processor on reasonable grounds relating to data protection, as set out in that agreement.
This page is published in English and Swedish. In the event of any discrepancy, the English version governs.
1. Processors acting on our instructions
Each provider below processes personal data only on our documented instructions, under terms that impose confidentiality, security and assistance obligations.
| Provider | Purpose of processing | Place of processing | Outside the EEA |
|---|---|---|---|
| Vercel Inc. | Hosting of the application and of the website, and storage of uploaded files | United States | Yes |
| Neon Inc. | Hosting of the database in which account data and content is stored | United States | Yes |
| Google Ireland Limited and Google LLC | Generation and analysis of text, images, video and speech | Ireland and United States | Yes |
| OpenAI Ireland Limited | Generation of text and assistant responses | Ireland and United States | Yes |
| xAI Corp. | Generation of images and video | United States | Yes |
| Replicate, Inc. | Generation and editing of images | United States | Yes |
| Mem0 | Storage of context remembered by the assistant between conversations | United States | Yes |
| Composio | Establishing and maintaining connections to accounts you connect | United States | Yes |
| Pipedream, Inc. | Establishing and maintaining connections to accounts you connect | United States | Yes |
| Outstand | Publishing to LinkedIn and retrieval of profile information | United States | Yes |
| Zernio | Publishing to connected accounts, and retrieval of comments, messages and statistics | United States | Yes |
| Sidemail | Delivery of transactional email | Czech Republic | No |
| 46elks AB | Delivery of text messages and handling of inbound and outbound telephone calls | Sweden | No |
| Apple Inc. (push notification service) | Delivery of push notifications to the mobile application | United States | Yes |
| Railway Corp. | Processing of video, including captioning and editing | United States | Yes |
| Grafana Labs | Collection of application logs for security and troubleshooting | United States | Yes |
| PostHog, Inc. (EU hosting) | Product analytics and error reporting, where analytics cookies have been accepted | European Union | No |
| Canva Pty Ltd | Creation and export of designs in your own Canva account | Australia | Yes |
| Oneflow AB | Generation and electronic signature of contracts | Sweden | No |
| RapidAPI and the providers of the data interfaces used | Retrieval of publicly available information from social platforms | United States | Yes |
Providers used only in development and testing environments, and providers that receive no personal data, are not listed. Our storage provider in production is Vercel; a separate storage provider is used only when the service runs in a development environment.
2. Recipients acting as independent controllers
The parties below are not our sub-processors. They decide for themselves how they use the personal data they receive and are independent controllers. We are not responsible for their processing, and a request concerning it must be made to them directly.
| Provider | Role |
|---|---|
| Meta Platforms Ireland Limited | Facebook, Instagram, Threads, Messenger and WhatsApp Business, for the accounts you hold and the content published to them |
| LinkedIn Ireland Unlimited Company | Publishing to your LinkedIn account, and the LinkedIn Insight Tag on our website where marketing cookies are accepted |
| TikTok Technology Limited | Publishing to your TikTok account |
| Google Ireland Limited | YouTube publishing, sign-in with Google, and calendar access where you grant it |
| X Corp. | Publishing to your X account |
| Pinterest Europe Limited | Publishing to your Pinterest account |
| Snap Inc. | Publishing to your Snapchat account |
| Telegram Messenger Inc. | Delivery of assistant messages over Telegram |
| Stripe Payments Europe Limited | Payment processing and payouts, including for the affiliate programme |
| Apple Inc. | Sign in with Apple, as identity provider |
| Shopify International Limited | Where you install the oriiion application in your Shopify store |
| Wint | Invoicing and accounting records |
The platforms listed become recipients only where you choose to connect an account with them, or where you contact us through a channel they operate.
3. Transfers outside the EEA
Where a provider is established outside the European Economic Area, we rely on one of the following safeguards under Chapter V of the General Data Protection Regulation:
- The Standard Contractual Clauses adopted by the European Commission, incorporated into the provider's data processing terms.
- The EU-US Data Privacy Framework, where the provider is certified under it.
- An adequacy decision of the European Commission covering the country concerned.
To ask which safeguard applies to a particular provider, or to request a copy of the relevant clauses, write to data@oriiion.ai.