Sub-Processors
This page lists the third parties (“sub-processors”) that GroveStreams LLC uses to provide the Services and that may process personal data or User Data on our behalf. It supplements our Privacy Policy and is incorporated into Annex III of our Data Processing Addendum, which is available upon request by contacting support@grovestreams.com.
Sub-processors are categorized as Operational (used for all customers as part of delivering the core Service) and Customer-Elected (used only when an Organization Administrator enables an optional feature in Organization Settings).
Operational Sub-Processors
| Sub-Processor | Function | Data Categories | Processing Location | EU/UK Transfer Mechanism |
|---|---|---|---|---|
| Amazon Web Services, Inc. Privacy |
Cloud hosting and email delivery (Amazon SES) for service-generated email | All User Data, account data, email contents | United States | EU-US Data Privacy Framework (self-certified) and Standard Contractual Clauses |
| Stripe, Inc. Privacy |
Payment processing and billing for new subscription tiers | Name, email, billing address, payment card details (held by Stripe; we store only customer/subscription identifiers) | United States | EU-US Data Privacy Framework (self-certified) and Standard Contractual Clauses |
| Authorize.Net (Visa, Inc.) Privacy |
Payment processing for legacy plan subscribers (no new sign-ups) | Payment card details (held by Authorize.Net; we store only a customer identifier) | United States | Standard Contractual Clauses |
| Twilio, Inc. Privacy |
SMS delivery for two-factor authentication and event/alert notifications | Phone number, SMS body | United States | EU-US Data Privacy Framework (self-certified) and Standard Contractual Clauses |
| Mapbox, Inc. Privacy |
Map tiles and geocoding for device/component location features | Device GPS coordinates, name, ID; address strings entered into the location search field | United States | Standard Contractual Clauses |
| Google LLC (Google Analytics) Privacy |
Website analytics on grovestreams.com (loaded only with cookie consent via CookieYes) | Anonymized IP address, browser, device, page-view metadata | United States | EU-US Data Privacy Framework (self-certified) and Standard Contractual Clauses |
Customer-Elected AI Sub-Processors
The following large-language-model providers are sub-processors only when an Organization Administrator enables AI features (AI Assistant, AI forecasting, model-builder) for that Organization in Organization Settings. If no provider is enabled, no data is sent to any of the providers below. The Organization Administrator selects the provider and is responsible for accepting that provider’s terms. See Terms §10 for details.
| Sub-Processor | Function | Data Categories | Processing Location | EU/UK Transfer Mechanism |
|---|---|---|---|---|
| OpenAI, L.L.C. Privacy |
LLM completions for AI features (when selected by the Organization Administrator) | The prompt and any metadata, schema, or stream context the user explicitly includes | United States | EU-US Data Privacy Framework (self-certified) |
| Anthropic, PBC Privacy |
LLM completions for AI features (when selected by the Organization Administrator) | The prompt and any metadata, schema, or stream context the user explicitly includes | United States | EU-US Data Privacy Framework (self-certified) |
| Google LLC (Gemini API) Privacy |
LLM completions for AI features (when selected by the Organization Administrator) | The prompt and any metadata, schema, or stream context the user explicitly includes | United States and other Google Cloud regions | EU-US Data Privacy Framework (self-certified) |
| X.AI LLC (Grok API) Privacy |
LLM completions for AI features (when selected by the Organization Administrator) | The prompt and any metadata, schema, or stream context the user explicitly includes | United States | Standard Contractual Clauses (via xAI’s Data Processing Addendum) |
Each of the AI sub-processors above represents in its current API terms that data submitted via the API is not used to train its foundation models in the default configuration. GroveStreams does not opt any customer’s data into provider training. Provider terms control and may change from time to time; the provider’s then-current policy governs.
Notice of Changes
GroveStreams will provide reasonable advance notice on this page before adding a new sub-processor or replacing an existing one in a way that materially affects the processing of personal data. Customers who have signed a Data Processing Addendum may object to a new sub-processor by contacting support@grovestreams.com before the new sub-processor is engaged.
Contact
Questions about this list, or to request our Data Processing Addendum, contact support@grovestreams.com.
Last Updated: May 3, 2026
