Legal
Sub-processors
Last updated: 2026-07-02
1. Introduction
In plain terms: these are the outside companies that help us run SearchChamp — our cloud host, our AI model providers, our SEO data source, our payment processor, and the Google services you choose to connect. We vet each one, bind them to data-protection terms, and tell you before we add a new one.
Atlio Information Technology LLC (“Atlio Information Technology”) uses the sub-processors listed below to deliver the SearchChamp platform. SearchChamp is a product of Atlio Information Technology. A sub-processor is a third-party company that processes personal data on Atlio Information Technology’s behalf in the course of providing services to our customers.
This list is maintained in accordance with our Data Processing Addendum and is updated whenever we add, change, or remove a sub-processor. Customers are notified at least 14 days before we add or replace a sub-processor, by email (if opted in) and by update of this page.
For the purposes of this list:
- SCCs refers to the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 2: Controller-to-Processor or Module 3: Processor-to-Processor as applicable).
- UK Addendum refers to the International Data Transfer Addendum to the EU SCCs issued by the UK ICO.
- Adequacy decision refers to a European Commission adequacy decision in effect at the time of transfer.
2. Current sub-processors
Last updated: 2026-07-02
| Sub-processor | Entity name | Purpose | Processing region | Transfer mechanism | Privacy policy |
|---|---|---|---|---|---|
| Amazon Web Services (AWS) | Amazon Web Services, Inc. (US) | Primary cloud infrastructure: application hosting (Lambda), relational database (RDS PostgreSQL), authentication (Cognito), storage (S3, DynamoDB), CDN (CloudFront), secrets management (Secrets Manager), event bus (EventBridge), message queues (SQS), and email delivery (SES). Hosts all production data. | eu-west-1 (Ireland) | Adequacy decision (EEA data stays in Ireland). SCCs for any cross-region replication. | aws.amazon.com/privacy |
| Anthropic | Anthropic PBC (US) | Claude API: powers SearchChamp’s AI agents (including Keyword Research, Content Writer, Site Auditor, AI Visibility Tracker, GTM Assistant, GA4 Insights, and llms.txt Generator) and the Claude engine of the AI Visibility feature. Processes content and instructions submitted to AI agent jobs and tracked prompts. | United States | Anthropic’s data processing terms, which incorporate SCCs (Module 3: Processor-to-Processor). Model inputs are not used to train Anthropic models under its commercial API terms. | anthropic.com/privacy |
| OpenAI | OpenAI, LLC (US) | OpenAI API: powers the ChatGPT engine of the AI Visibility feature (queries your tracked prompts automatically) and specific AI agent tasks where OpenAI models are used. Processes content and instructions submitted to those jobs. | United States | OpenAI’s data processing terms, which incorporate SCCs (Module 3: Processor-to-Processor). API inputs are not used to train OpenAI models under its API terms. | openai.com/privacy |
| Perplexity | Perplexity AI, Inc. (US) | Perplexity API: powers the Perplexity engine of the AI Visibility feature — queries the prompts you choose to track and returns engine answers for citation analysis. | United States | Perplexity’s data processing terms; transfers safeguarded as described in section 8 of our DPA. | perplexity.ai/privacy |
| xAI | xAI Corp. (US) | xAI (Grok) API: powers the Grok engine of the AI Visibility feature — queries the prompts you choose to track and returns engine answers for citation analysis. | United States | xAI’s data processing terms; transfers safeguarded as described in section 8 of our DPA. | x.ai/privacy |
| DataForSEO | DataForSEO OÜ (Estonia) | SEO data API: provides keyword volume, SERP data, backlink metrics, and site-audit data. Queries are limited to keywords, URLs, and domain names submitted by users and are not intended to contain personal data. | Estonia (EU) | Intra-EU processing (no third-country transfer mechanism required). Queries are limited to keywords, URLs, and domain names. | dataforseo.com/privacy-policy |
| Stripe | Stripe, Inc. (US) | Payment processing: handles all subscription billing, payment-method storage, invoicing, and refunds. Processes billing name, email, billing address, and payment card data. | United States / Global | SCCs (Module 2: Controller-to-Processor) for EEA/UK customers. UK Addendum where applicable. Stripe is PCI-DSS Level 1 certified. | stripe.com/privacy |
| AWS — Cognito (service detail) | Amazon Web Services, Inc. (US) | Identity and access management: stores user accounts, hashed passwords, MFA configuration, and issues JWT tokens. Used for authentication and authorisation. | eu-west-1 (Ireland) | Adequacy decision (EEA data stays in Ireland). Included in the AWS DPA. | aws.amazon.com/privacy |
| Google LLC / Google Ireland Limited | Two distinct uses: (1) Integration APIs you explicitly connect — Google Search Console (search query and click data), Google Analytics 4 (audience and traffic metrics), and Google Ads (campaign and keyword data) — read on your behalf via OAuth tokens you authorise and can revoke at any time; connecting a Google account is optional. (2) The Gemini generative API, which powers the Gemini engine of the AI Visibility feature (queries your tracked prompts) and certain AI generation tasks — this use does not require a connected Google account. | Global (Google data centres) | SCCs (Module 3: Processor-to-Processor) and Google’s Data Processing Terms for EEA/UK customers. No data is shared with Google for advertising; integration access is read-only on your authorised properties. | policies.google.com/privacy |
Data categories processed by each sub-processor
| Sub-processor | Personal data categories | Non-personal data categories |
|---|---|---|
| AWS (infrastructure) | Account data, usage logs, IP addresses, AI agent outputs, billing records | Application code, configuration, anonymised metrics |
| Anthropic | Potentially: content submitted in AI agent prompts (may include personal data if user submits it) | Keywords, URLs, SEO instructions |
| OpenAI | Potentially: content submitted in AI agent prompts (may include personal data if user submits it) | Keywords, URLs, SEO instructions |
| Perplexity | Potentially: tracked prompts you configure (may include personal or brand data you submit) | AI Visibility prompt text, engine responses, citation data |
| xAI | Potentially: tracked prompts you configure (may include personal or brand data you submit) | AI Visibility prompt text, engine responses, citation data |
| DataForSEO | None intended — queries are limited to keywords, URLs, and domain names; incidental personal data in a user-submitted keyword or URL remains protected under EU law (intra-EU processing) | Keywords, URLs, domain names |
| Stripe | Name, email, billing address, payment card data (PAN is never transmitted to SearchChamp servers) | Subscription plan identifiers, payment amounts |
| AWS — Cognito | Email address, hashed password, MFA settings, device fingerprints | JWT token configuration |
| OAuth account identifier and email of the connecting user; any personal data contained in your own GSC/GA4/Ads property data | Search queries, click and impression metrics, traffic and audience metrics, campaign and keyword data |
3. Changes to this list
Atlio Information Technology will update this page whenever a sub-processor is added, changed, or removed. The addition or replacement of a sub-processor will be communicated to customers at least 14 days in advance, consistent with section 5 of our Data Processing Addendum.
Notification methods:
- Email to the primary account holder (for customers who have opted in to sub-processor notifications);
- Update of this page with a revised “last updated” date.
Customers may object to a new sub-processor as described in section 5 of the Data Processing Addendum.
Change history
| Date | Change |
|---|---|
| 2026-07-02 | Disclosure correction: added Perplexity and xAI (AI Visibility engines in use since the feature launched) and documented Google’s Gemini API use; corrected DataForSEO’s legal entity to DataForSEO OÜ (Estonia); clarified AI-provider retention terms and AWS service list. No new processing was introduced. |
| 2026-05-11 | Initial publication of sub-processor list. |
4. Contact
To opt in to sub-processor change notifications, or for questions about our sub-processors:
Atlio Information Technology LLCDubai, United Arab Emirates
Email: [email protected]