Subprocessors

How changes are notified

Under §5 of the Data Processing Addendum we give at least 30 days' notice before adding or replacing a subprocessor. Notice goes to each customer's administrative contact by email, and this page is updated at the same time. A customer may object on reasonable data protection grounds within that period; if we cannot accommodate the objection, they may terminate the affected subscription without penalty.

We may replace a subprocessor on shorter notice where it is necessary to preserve security or continuity (a provider suffering a breach, for instance) and will explain why as soon as practicable.

To be notified without being a customer, email privacy@dmcpilot.com.

Reading the health-data column

One class of data in the platform is special category data under Article 9 of the GDPR: dietary requirements and allergies. Because that carries stricter obligations, the tables below say for every provider whether it can receive it.

• Yes, the provider holds or transports this data as part of its normal function. 3 of 15 providers.
• Only if present, the provider does not handle it by design, but could receive it incidentally: inside an error report, a log line, or a specific request that needed it.
• No, the data cannot reach this provider by any path.

Health data reaches an AI provider only when someone asks a question that requires it, over a zero-data-retention endpoint, and each such access is written to the activity log. It is not included in the routine context supplied to the assistant.

The register

Infrastructure

Communications and payments

Artificial intelligence

Operational data sources

Why AI providers are listed individually

Every model call in the platform goes through a single gateway, OpenRouter. It would be tempting to list only the gateway and stop, but that would be misleading: a gateway routes, and the provider it selects has its own terms. So the upstream providers are named separately, because they are the ones actually running the inference.

Two settings govern this, and both are applied rather than assumed. Every request is sent with data collection denied, which excludes any provider that stores or trains on inputs. That matters because the gateway's default is to permit them. Requests that could carry health data additionally require zero-data-retention endpoints, which do not retain the request at all; if none is available the request fails rather than routing somewhere that would keep it. Independently, the account-level settings with the gateway exclude every training endpoint and enable zero retention for the providers this platform uses.

One limitation worth naming: zero-retention guarantees do not extend to search plugins, and the research feature performs web search. We therefore send no attendee data on that path at all, only company and destination names.

Location and transfers

Every provider above operates in or from the United States. Personal data of people in the EEA, the UK and Switzerland therefore leaves those territories, which requires an Article 46 safeguard. The technical measures supporting such transfers are in place; the Standard Contractual Clauses and a per-provider transfer impact assessment are outstanding, as stated in §11 of the Addendum. EU data residency is not available today.

What is not on this list

Services that receive no personal data are excluded on purpose, so that the register stays the list of places personal data actually goes. Flight tracking receives flight numbers and dates; mapping receives addresses and place queries. Neither receives a name.

We use no advertising, marketing-automation, data-broker or behavioral-analytics provider of any kind, on the website or in the product. The website's analytics are cookieless and aggregate, see the Cookie Notice.