Sprii Sub-Processor List

2. Document version

3. Purpose

This list names thesub-processors Sprii engages to process personal data on behalf of itscustomers. It is referenced by, and forms part of, the Sprii Data ProcessingAddendum (DPA). Customers give general written authorisation for thesesub-processors under the DPA (GDPR Article 28(2)).

Each sub-processor is bound bydata protection obligations equivalent to those in the DPA (Article 28(4)).This list is the single source of truth for the current sub-processors; it ismaintained separately from the DPA so it can be kept current without re-issuingthe DPA itself.

4. Current sub-processors

On commencement of the DPA, thecustomer authorises the engagement of the following sub-processors.

Entries whose purpose startswith “Optional” are used only when the customer switches on the feature thatneeds them. If the customer never switches that feature on, the sub-processordoes not process the customer’s data.

4.1 Google (Firebase, Google Cloud)

Address: Gordon House,Barrow Street, Dublin 4, Ireland. Servers used by Sprii: in the EU, mainly St.Ghislain, Belgium, for the platform. Live-video servers run in the Google Cloudregion nearest the customer’s streaming country, which can be outside the EEA.

Purpose and data: Firebasehosts Sprii's software and database (purchase, product and comment data).Google Cloud also stores live-show recordings (Cloud Storage), holds viewingand order analytics, including viewer IP address and browser data (BigQuery),keeps service logs (Cloud Logging), runs live-video servers (Compute Engine)and, when the customer switches on live captions, transcribes the host’s voice(Speech-to-Text).

Transfer safeguard: Transferto Google LLC (United States) under the EU-U.S. Data Privacy Framework, with EUStandard Contractual Clauses as a fallback safeguard.

Reference: firebase.google.com/terms/data-processing-terms(Firebase); cloud.google.com/terms/data-processing-addendum (Google Cloud).

4.2 Elasticsearch B.V.

Address: Keizersgracht281, 1016 ED Amsterdam, The Netherlands. Servers used by Sprii: Frankfurt,Germany.

Purpose and data: Searchengine enabling efficient search across large amounts of data, for example tofind all orders relating to a specific customer. Processes customer orders andproducts.

Transfer safeguard: EU-hosted(Frankfurt). No third-country transfer for Sprii's use.

Reference: www.elastic.co/trust

4.3 Mux, Inc.

Address: 1 Front Street,Suite 2050, San Francisco, CA 94111, USA (EU processing region enabled).

Purpose and data: Videoinfrastructure: encoding, storage, streaming and playback for live andon-demand video shown to end-users and viewers, plus playback analytics (MuxData). Processes viewer IP and usage data; configured to the EU region with IPtruncation.

Transfer safeguard: DPAin place; EU processing region; SCCs for any US transfer.

4.4 OpenRouter, Inc.

Address: 169 MadisonAvenue #2404, New York, NY 10016, USA.

Purpose and data: AIgateway for the platform’s AI features: product reservations from comments,comment categorisation, sentiment and competition detection, and translation oflive captions. Receives comment or caption text and an internal message IDonly, never names or contact details, and routes only to the authorised modelproviders below. Zero data retention; no training on inputs or outputs.

Transfer safeguard: EUStandard Contractual Clauses (2021/914, Module Two) in the OpenRouter DataProcessing Agreement, with the UK Addendum and a Swiss variant. Data hosted inGoogle Cloud US regions. SOC 2 Type II certified.

4.5 Authorised model providersengaged via OpenRouter

Providers: Google LLC(Gemini models); Anthropic (Claude models); OpenAI gpt-oss open-weight models,served by the inference hosting provider(s) selected by OpenRouter’s routingand listed in OpenRouter’s published sub-processor list, which is incorporatedinto this list by reference.

Purpose and data: Modelinference on the comment text routed by OpenRouter, under the samerestrictions: zero data retention, no training on inputs, processing limited toreturning the analysis result.

4.6 Anthropic

Address: AnthropicIreland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, Ireland(Sprii’s contracting entity). Processing by its parent, Anthropic, PBC, 548Market Street, PMB 90375, San Francisco, CA 94104, USA.

Purpose and data: Optional.AI assistant (Claude), used on the customer’s request to turn campaign commentexports (display names and comment text) into campaign reports. Source filesare deleted once the report is delivered, and within 30 days of export. ViaAnthropic’s API: no training on inputs and no retention of conversation contentby default.

Transfer safeguard: EUStandard Contractual Clauses (2021/914, Module Three). Processing in the UnitedStates; Anthropic is not certified under the EU-U.S. Data Privacy Framework.

4.7 OpenAI

Address: OpenAI IrelandLimited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper,Dublin 1, D01 YC43, Ireland (Sprii’s contracting entity). Processing by OpenAIOpCo, LLC, 1455 3rd Street, San Francisco, CA 94158, USA.

Purpose and data: AIanalysis of comment and chat text for the platform’s AI features(categorisation, sentiment, competition detection) and, on the customer’srequest, sentiment analysis for a campaign brief. Inputs are limited to commenttext with identifiers minimised: the brief route removes names and contactdetails, and automated features send a display name only where the featureneeds it. No training on inputs. Automated features reach OpenAI models viaOpenRouter. Sprii also calls the OpenAI API directly to read productinformation from customers’ web pages, which involves no personal data.Campaign briefs use Sprii’s managed ChatGPT Business workspace, where threadsand exports are deleted once the brief is delivered, and within 30 days ofexport.

Transfer safeguard: EUStandard Contractual Clauses (2021/914, Module Three). OpenAI is not certifiedunder the EU-U.S. Data Privacy Framework.

4.8 Render Services, Inc.

Address: 525 BrannanStreet, Suite 300, San Francisco, CA 94107, USA (EU processing region:Frankfurt, Germany).

Purpose and data: Applicationhosting (platform-as-a-service) for Sprii services that process viewer data,including the live-stream graphics overlay, the TikTok live-comment listenerand server-side rendering (comment text, display names, IP addresses,interaction data). Static front-end assets, which contain no personal data, areserved from Render’s global content delivery network.

Transfer safeguard: EUregion (Frankfurt) for all hosted services; no third-country transfer ofapplication data. The global content delivery network processes only requestmetadata such as IP addresses; for that, Render is certified under the EU-U.S.Data Privacy Framework (including the UK Extension and the Swiss-U.S.framework), with the Standard Contractual Clauses in Render’s DPA as fallback.

4.9 Hetzner Online GmbH

Address: Hetzner OnlineGmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (Amtsgericht Ansbach, HRB6089).

Purpose and data: Live-videoingest (RTMP/SRT) and transcoding on Hetzner Cloud servers. Processes thebroadcast video, which may show people, and connection metadata such as IPaddresses. Processing is transient; nothing is stored there.

Transfer safeguard: EU-hosted(Nuremberg and Falkenstein, Germany; Helsinki, Finland). No third-countrytransfer. Data processing agreement in place under German law.

4.10 ClickHouse, Inc.

Address: 601 MarshallStreet, Redwood City, CA 94063, USA. Servers used by Sprii: Frankfurt, Germany(AWS eu-central-1).

Purpose and data: Analyticsdatabase (ClickHouse Cloud, with managed Postgres) for reporting on orders andviewing. Holds a copy of order data, including end-users’ names, addresses,email addresses and phone numbers, and viewing events linked to an end-user ID.

Transfer safeguard: EU-hosted(Frankfurt). Any access from the United States is covered by the EU-U.S. DataPrivacy Framework, with EU Standard Contractual Clauses (2021/914) inClickHouse’s Data Processing Addendum as a fallback.

Reference: clickhouse.com/legal/agreements/data-processing-addendum

4.11 Decodo (UAB “Data troops”)

Address: Švitrigailos g.34, Vilnius, Lithuania (company code 305893779).

Purpose and data: Optional.Proxy network that carries the connections Sprii makes to Instagram when thecustomer streams to Instagram through Sprii’s streaming infrastructure, usingthe InstaSprii feature. The traffic includes Instagram usernames and commenttext.

Transfer safeguard: EUcompany. Decodo’s Data Processing Agreement applies, with EU StandardContractual Clauses (2021/914) for any route outside the EEA.

Reference: decodo.com/legal/data-processing-agreement

4.12 TypeSafe AI, Inc.

Address: 255 CaliforniaStreet, Suite 1300, San Francisco, CA 94117, USA.

Purpose and data: Optional.AI moderation of the onsite chat and recognition of questions in comments, whenthe customer switches these features on. Processes chat display names andmessage text for moderation, and comment text only for question recognition.

Transfer safeguard: EUStandard Contractual Clauses (2021/914, Module Two) in TypeSafe’s DataProcessing Addendum. Processing in the United States.

Reference: typesafe.ai/legal/data-processing

Services that the customer connects to Sprii itself, such asits payment and shipping providers, its webshop platform and its own Meta andTikTok accounts, act on the customer’s behalf under the customer’s ownagreements and are not Sprii’s sub-processors.

Sprii is not entitled, withoutthe customer's explicit written authorisation, to engage a sub-processor for adifferent processing than the one agreed, or to have another sub-processorperform the described processing.

5 How we change sub-processors, andhow you object

Sprii will notify the customerof any planned change concerning the addition or replacement of asub-processor, giving the customer the opportunity to object. Notice will reachthe customer at least one month before the change takes effect.

If the customer objects, thecustomer must notify Sprii within 14 days of receiving the notice. The customermay object only on reasonable, concrete grounds relating to data protection.The parties will seek a resolution in good faith; if none is reached, thecustomer may terminate the part of the service affected by the sub-processor.

HOW WE NOTIFY

Until a dedicated privacy contact is registered per account, Sprii notifies the registered platform users on the account by email and posts the change on this list. Each notice names the sub-processor, its role and location, and the 14-day objection window.

6 Scope and conditions

This list is part of the SpriiDPA and is not a standalone contract. It is reviewed on every sub-processorchange, and at least annually.