Legal Templates
Sub-processor / DPA disclosure
Copy-paste language identifying ARCY AI as a sub-processor in your own DPA or sub-processor list.
If you're the data controller for your end users and you've signed (or need to sign) data processing agreements with your own customers, you likely need to list ARCY AI as a sub-processor, along with ARCY AI's own sub-processors.
This is boilerplate, not legal advice. Have your own counsel review it, and request ARCY AI's own DPA (see below) before relying on this for a regulated customer relationship.
What to paste
Sub-processor: ARCY AI
Purpose: In-product user guidance, assistance, and behavioral analytics
within [Your Product Name].
Data processed: Session and interaction data described in our Privacy
Policy's "Third-Party Product Assistance" section, and any account
identifiers or traits we choose to share with ARCY AI.
Location of processing: ARCY AI's core infrastructure, including AI
processing, is hosted within the European Union. ARCY AI's own
sub-processors include providers based outside the EU; see ARCY AI's
sub-processor list below.
ARCY AI's own sub-processors (as of this writing):
| Provider | Purpose |
|---|---|
| Amazon Web Services (AWS) | Hosting, database, and AI inference |
| Clerk | Authentication and session management |
| Resend | Transactional email |
| Stripe | Billing (only if you connect Stripe billing) |
ARCY AI does not sell or share sub-processor data with third parties for
their own purposes. For ARCY AI's current, authoritative sub-processor list,
see https://docs.arcyai.com/compliance/sub-processors. To request ARCY AI's
Data Processing Agreement or security questionnaire, contact
contact@arcyai.com.Notes on filling this in
- Don't hardcode ARCY AI's sub-processor table into a document you don't intend to keep updated. Consider linking to Sub-processors instead of copying the table, so it stays current if ARCY AI adds or removes a provider.
- ARCY AI's GDPR posture is "in progress," not certified, as tracked honestly on Certification status. If your own DPA requires you to represent your sub-processors' certification status, reflect that accurately rather than assuming completion.
- A signed DPA with ARCY AI is available on request via Data processing agreements. If you're in a regulated industry (HealthTech, FinTech, government), request it and confirm terms before relying on this disclosure for a customer contract.