Subprocessors

1. Core subprocessors

These are engaged for every customer. They cannot be switched off while you use the service.

2. Subprocessors engaged by your own choices

These are engaged only when you connect the corresponding channel, integration or feature. If you never connect it, no data of yours reaches that vendor.

The AI model provider currently configured for the platform is [AI PROVIDER]. The product is built against a provider-neutral interface, so this can change; a change is announced as described in "Changes and your right to object".

When you connect a channel, that provider is also a controller in its own right for the account and the platform identifiers it already holds. Its own terms and privacy policy apply to you and to the people who message you there, in addition to ours.

3. Hosting and infrastructure

The application, its PostgreSQL database, its Redis cache, its message bus and its ClickHouse analytics store run on infrastructure we operate ourselves at [HOSTING PROVIDER AND REGION]. These components are not managed data services resold by a third party; the hosting provider supplies the machines and the network.

Support ticket attachments are stored on that same infrastructure, on the application's own disk. They are not placed in a third-party object storage service.

4. What we deliberately do not use

Stating the absences is as useful as stating the list. As of the date at the top of this page, the product contains no integration with any of the following, and none of them receives your data:

• No third-party product analytics or session-recording tool (no Google Analytics, no PostHog, no Mixpanel, no session replay) in the application.
• No third-party error-tracking or APM vendor (no Sentry, no Datadog, no New Relic).
• No advertising network, data broker or audience-enrichment provider.
• No third-party object storage provider for your files.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

5. How we engage a subprocessor

Before a vendor is added, we assess what data it would receive, whether the same outcome is achievable with less data, and what its own data protection commitments are. We engage each subprocessor under a written contract that binds it to obligations no less protective than those we owe you, including confidentiality, security measures and assistance with data subject rights.

Credentials for every connected integration are encrypted at rest with AES-256-GCM before being stored, and we send each subprocessor only the data it needs for the purpose listed above.

6. Changes and your right to object

You give general authorisation for us to engage the subprocessors listed here and to replace or add to them as the service evolves. Before a new subprocessor starts processing your data, we will update this page and the date at the top of it, and we will give at least 30 days' notice by email to the account address.

If you have a reasonable, data-protection-related objection to a new subprocessor, tell us at [DPO EMAIL] within those 30 days. We will work with you in good faith to find an alternative — for example, disabling the feature that requires it. If no reasonable alternative exists, you may terminate the affected part of the service without penalty, with a pro-rata refund of fees already paid for the unused period.

The 30 days are enforced by the software, not by our memory

A published deadline that depends on someone remembering it is not really a deadline. Ours does not: the internal tool that sends a subprocessor notice checks the effective date against the 30 days and REFUSES to send a notice that does not clear it, telling the sender how many days the chosen date actually gives. Nobody at Publiq can shorten this notice period by being in a hurry — the API will not accept it.

Who is notified, and where the history lives

• The notice goes to the people who answer for the contract in each organisation — the owner and the administrators. Developer and viewer roles do not receive it, because they neither exercise the objection nor accept a change of terms, and contractual matters should not be circulated wider than the people responsible for them.
• An organisation whose account is suspended is still notified. Suspension is temporary and reversible: the data is still with us and the contract is still in force, so the change binds that organisation just the same — and a change of policy is precisely what someone under suspension most needs to read. Silencing the customer we ourselves restricted would mean choosing not to warn exactly the person with most to lose.
• An organisation that has been archived is not notified. Archiving is definitive offboarding; the relationship is over, and telling someone who has left about a future change to a contract they no longer have is noise.

Every notice is also written to the audit trail of your own organisation, with its type, its reference, its subject and its effective date. So the record of what you were told does not depend on your inbox: you can look it up in the application, months later, without asking us and without trusting that an email survived a filter. Neither that entry nor our own register of notices is deleted by age.

You do not need to subscribe to anything — if you hold an owner or admin role, you are already on the list.

7. Contact

Questions about this list: [DPO EMAIL]. Controller: [LEGAL ENTITY NAME], [CNPJ], [REGISTERED ADDRESS].