To provide the Toong service we engage a small number of third-party sub-processors. Each is bound by a data processing agreement and processes personal data only on our documented instructions, with appropriate security measures. This page lists them for transparency under Article 28 GDPR.
Core sub-processors
Used to run the platform for every customer.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting, database, storage and encrypted backups | All platform data (account details, conversations, uploaded content) | United States (hosted in the selected AWS region) |
| OpenAI | AI language processing: generating the assistant's replies | Message content sent to produce a reply (not used to train their models, per API terms) | United States |
| Amazon SES (Amazon Web Services) | Delivery of transactional email: verification codes, receipts, notifications | Recipient email address and the content of that email | Ireland (EU) |
| Google Firebase Cloud Messaging / Apple Push Notification service | Push notifications to the Toong mobile app (Android / iOS) | Device push token and the notification text (e.g. “A chat needs you: Nord Furniture”) | United States / Ireland (EU) |
Feature sub-processors
Engaged only when you enable the related feature (a channel, scheduling, or payments).
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Meta Platforms Ireland / Inc. | Message delivery on connected Facebook, Instagram and WhatsApp channels | Messages and platform-scoped identifiers for the connected accounts | Ireland (EU) / United States |
| Telegram / Rakuten Viber | Message delivery on connected Telegram bots and Viber accounts | Messages and platform-scoped identifiers for the connected accounts | United Arab Emirates / Luxembourg (EU) |
| Google (Google Ireland / LLC) | Calendar availability and Google Meet links, when Google Calendar is connected | Calendar free/busy and events created on the connected calendar | Ireland (EU) / United States |
| Paysera / Stripe | Payment processing for subscriptions and, when enabled, in-chat payment links | Transaction data; card/bank details are entered on the provider's page and never reach Toong | Lithuania (EU) / Ireland (EU) |
International transfers
Where a sub-processor processes personal data outside the EEA, transfers are made under an appropriate safeguard such as the European Commission's Standard Contractual Clauses.
Changes & notice
We keep this page current. Customers with a signed Data Processing Agreement are entitled to advance notice of new sub-processors and may raise a reasonable objection. Questions: [email protected].