This page lists the third parties TSSG engages to process personal data on behalf of our customers. It exists because Article 28 of the GDPR gives you the right to know who they are and to object when they change, and because your own privacy notice needs to name them.

This list applies only to the Managed AI Service, which is optional and available on the Sovereign tier. If you have not enabled Managed AI, TSSG processes no personal data on your behalf and none of the entries below apply to you.

What Is and Is Not on This List

On this list: processors TSSG engages, on your behalf, in the course of operating the Managed AI Service.

Not on this list, deliberately:

• Twilio, Stripe, and your email or SMTP provider. You hold those accounts directly. Data flows from your WordPress site to them without passing through us. They are your sub-processors and belong in your privacy notice, not on this page.
• AI providers whose API keys you supply. In own-key mode, we are not in the path. That provider is yours.
• Your WordPress host. Your business data lives there, under your contract with them.
• Analytics or advertising vendors. We use none in connection with the Managed AI Service.

Current Sub-processors

Google LLC (Gemini API)

Role: AI model provider. Generates responses to requests routed through the Managed AI Service.

Data processed: Request content, which may include client names, contact details, addresses, and financial figures retrieved from your CRM by the request, plus the generated response.

Location: United States and other countries where Google operates. See Data Residency below.

Cloudflare, Inc.

Role: Edge compute, request routing, rate limiting, and usage metering storage for the Managed AI Service.

Data processed: Request content in transit; licence identifier, timestamps, and token counts at rest.

Location: Global edge network, with metering storage in the United States.

Resend, Inc.

Role: Transactional email for operator alerts (spend and rate-limit notices sent to TSSG).

Data processed: Alert type, licence identifier, timestamp, and spend figures, addressed to TSSG’s own operator mailboxes. Contains no customer or end-client personal data and no request content.

Location: United States.

Freemius, Inc.

Role: Licence validation. The Managed AI Service verifies your licence key against Freemius before serving a request.

Data processed: Your licence key and the plan, expiry, and cancellation status returned for it. No client data of any kind.

Location: United States.

Freemius is listed here for completeness because the Managed AI path touches it. It is your own purchase relationship rather than a processor of your clients’ data.

Model Provider Terms

Requests sent through the Managed AI Service are made under Google’s paid Gemini API terms, which apply because our project is bound to an active billing account. Under those terms:

• Google does not use prompts, system instructions, cached context, or responses to train or improve any Google AI model.
• Paid-tier inputs and outputs are not subject to human review, evaluation, or annotation.
• Data is logged transiently for platform security, operational stability, abuse prevention, and legal compliance, then deleted.
• Google claims no ownership of the content generated by our API calls.

If we change model provider, or if the terms above change materially, this page will be updated and notice given as described below.

Providers Not Currently in Use

The Managed AI Service is built to support more than one model provider so we can move if one degrades or retires a model. Only the providers listed above receive any data today. Adding another to live traffic is a sub-processor change and gets the same 30 days’ notice as any other.

Data Residency

We want to be straightforward about a limitation rather than imply a guarantee we do not have.

The Managed AI Service does not offer a data residency guarantee. Google’s standard Gemini API processes requests across its global infrastructure and does not pin machine learning processing to a chosen region. Regional and jurisdictional processing is available through Google’s enterprise platform, which we do not currently use. Requests should therefore be assumed to be processed in the United States and potentially in other countries where Google operates.

Transfers out of the EEA, the UK, and Switzerland are made under the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, as set out in our Data Processing Agreement.

If your business requires processing confined to a specific jurisdiction, use own-key mode with a provider configuration that meets your requirement, or contact us to discuss options.

Notice of Changes and Your Right to Object

We will post any addition or replacement of a sub-processor here at least 30 days before it begins processing, and will email customers with Managed AI enabled at the same time.

If you object to a new sub-processor on reasonable data protection grounds, tell us at [email protected] within those 30 days. We will work with you in good faith to find an alternative. If we cannot, you may disable Managed AI and continue on own-key mode, or terminate the Sovereign subscription and receive a prorated refund of the unused remainder of your term.

Change History

2026-08-17. Page published. Google LLC, Cloudflare Inc., Resend Inc., and Freemius Inc. listed as the initial sub-processors for the Managed AI Service.