Subprocessors
The public list of suppliers we engage in processing personal data on our customers’ behalf (Art. 28(2) GDPR). It is part of our Data Processing Agreement.
Current list
| Supplier | Purpose | Location | Safeguards |
|---|---|---|---|
| Vercel Inc. | hosting of kaen.cz and the Kaen app, CDN | USA / EU (edge network) | DPA, EU standard contractual clauses (SCC) |
| Supabase, Inc. | database, authentication and file storage — storage of leads, findings, variations and test results | EU (Frankfurt region) | DPA; data stays in the EU |
| Anthropic, PBC | analysis of funnel data and drafting of findings using large language models (Claude) | USA | DPA, SCC; inputs are not used to train the models under the supplier’s commercial terms |
| OpenAI, L.L.C. / OpenAI Ireland Ltd | analysis of funnel data and drafting of findings using large language models (GPT) | USA / EU | DPA, SCC; inputs are not used to train the models under the supplier’s commercial (API) terms |
| Stripe, Inc. / Stripe Payments Europe, Ltd. | card payment of invoices | EU / USA | DPA (Data Transfers Addendum), SCC |
| Resend (Plus Five Five, Inc.) | transactional e-mail (lead confirmation, results notifications) | EU region | DPA, SCC |
| Slack Technologies, LLC (Salesforce) | internal lead notifications and shared channels with customers | USA / EU | DPA, SCC |
| Google Ireland Limited | Google Workspace — e-mail, calendar and documents used to run the engagement | EU / USA | DPA, SCC |
| Stape Inc. | connector we use for read-only access to the customer’s GA4 (proxy for the analytics API) | EU / USA | DPA, SCC; read-only scope, access granted through the customer’s own Google account |
| PostHog, Inc. | product analytics of kaen.cz and the Kaen app | EU (EU Cloud) | DPA; data stays in the EU |
| Calendly LLC | booking of demo calls | USA | DPA; EU–US Data Privacy Framework (DPF) |
The customer’s own tools
We also work in tools that belong to the customer — GA4, Google Tag Manager, PostHog, Clarity, Hotjar, BigQuery, a payment provider, or the customer’s own team chat or workspace such as Slack, Microsoft Teams or Basecamp. We access those under the customer’s own account and contract, so they are not our subprocessors; the customer remains the controller and keeps its own agreements with those providers. We ask for read-only access wherever that is enough.
A note on AI suppliers
Analysis is done with large language models from Anthropic and OpenAI, chosen per task. Under both suppliers’ commercial terms, inputs are not used to train their models. We limit the risk further: we send the smallest amount of data the analysis needs, prefer aggregated and pseudonymised data over raw records, and do not send contact details where the analysis does not require them.
Changes to this list
We announce an intended addition or replacement of a subprocessor at least 30 days in advance by updating this page and e-mailing our customers. The customer (controller) may object on reasonable data protection grounds — the procedure and its consequences are described in the DPA, clause 7.
Questions about processing: hello@kaen.cz.
Version 2026-09-18, effective from 18 September 2026. List last changed: 6 October 2026.