Subprocessors

Privacy Policy GDPR Data Protection Subprocessors

AiMingle, s.r.o. provides its Service (referred to here as “FlowHunt”) to You through its website located at flowhunt.io and the FlowHunt application at app.flowhunt.io.

AiMingle, s.r.o. uses certain subprocessors to assist it in providing the FlowHunt Service.

What is a subprocessor:

A subprocessor is a third party data processor engaged by FlowHunt, who has or potentially will have access to or process Service Data (which may contain Personal Data). FlowHunt uses various types of sub-processors to perform different functions as explained in the tables below.

Due diligence:

FlowHunt undertakes to use a commercially reasonable selection process by which it evaluates the security, privacy and confidentiality practices of proposed subprocessors that will or may have access to or process Service Data.

Contractual safeguards:

FlowHunt requires its subprocessors to satisfy equivalent obligations as those required from FlowHunt (as a Data Processor) as set forth in FlowHunt’s Data Processing Agreement (“DPA”), including but not limited to the requirements to:

– process Personal Data in accordance with data controller’s (i.e. Subscriber’s) documented instructions (as communicated in writing to the relevant subprocessor by FlowHunt);

– in connection with their subprocessing activities, use only personnel who are reliable and subject to a contractually binding obligation to observe data privacy and security, to the extent applicable, pursuant to applicable data protection laws;

– provide regular training in security and data protection to personnel to whom they grant access to Personal Data;

– implement and maintain appropriate technical and organizational measures;

– promptly inform FlowHunt about any actual or potential security breach; and cooperate with FlowHunt in order to deal with requests from data controllers, data subjects or data protection authorities, as applicable.

This policy does not give Customers any additional rights or remedies and should not be construed as a binding agreement. The information herein is only provided to illustrate FlowHunt’s engagement process for subprocessors as well as to provide the actual list of third party subprocessors as of the date of this policy (which FlowHunt may use in the delivery and support of its Services).

Our DPA forms part of our Terms and Conditions and applies to all FlowHunt customers without a separate signature. If you need a signed copy of the DPA, please email us at support@flowhunt.io .

Client-specific Subprocessors (infrastructure subprocessors)

FlowHunt owns or controls access to the infrastructure that FlowHunt uses to host Service Data submitted to the Services, other than as set forth below. The FlowHunt production systems are hosted on Amazon Web Services and Google Cloud Platform in the European Union. The following table describes the infrastructure engaged in the storage and processing of Service Data by FlowHunt.

ServiceDescription
ServersAmazon Web Services, eu-central-1 (Frankfurt)
FlowHunt servers are hosted at Tier III+ or IV or PCI DSS, SOC 1, SOC 2, or ISO 27001 compliant facilities. Data center facilities are powered by redundant power, each with UPS and backup generators.
File storageAmazon S3, eu-central-1 (Frankfurt)
Stores uploaded documents, knowledge source files, chat attachments, and attachments delivered by triggers such as the Gmail trigger.
BackupsAmazon AWS S3
Service Data backups are stored securely on Amazon AWS S3.
Embedding ServiceGoogle Vertex AI, europe-west3 (Frankfurt)
Used for generating embeddings of knowledge source content and documents so that they can be searched. This service is not configurable by the user.
Data warehouseGoogle BigQuery, europe-west3 (Frankfurt)
Stores keyword and analytics data used by data and reporting features, including data imported from connected platforms for Am I Cited.

Vendor Subprocessors

FlowHunt uses certain vendor subprocessors to assist in providing the FlowHunt Service. In order to provide relevant functionality, these subprocessors may access Service Data.

EntityCountryService
AiMingle, s.r.o.Czech RepublicProcessor - Services
AiMingle, s.r.o. is a Quality Unit member entity. AiMingle, s.r.o. functions as a processor to provide the FlowHunt Service.
Quality Unit, s.r.o.SlovakiaOther subprocessor - Services
Quality Unit, s.r.o. is a Quality Unit member entity. Quality Unit s.r.o functions as a subprocessor providing certain infrastructure, billing, and support services for the FlowHunt Service, including the LiveAgent customer support platform.
Quality Unit, LLCUnited StatesOther subprocessor - Services
Quality Unit, LLC is a Quality Unit member entity. Quality Unit, LLC functions as a subprocessor to provide the FlowHunt Service.
Quality Unit Ukraine, LLCUkraineOther subprocessor - Services
Quality Unit Ukraine functions as a subcontractor to provide the FlowHunt Service.
Makara Partner, s. r. o.SlovakiaOur accounting may access Service Data in order to create and process invoices.
Stripe, Inc.United StatesPayments
Payment and bank card details are securely stored and processed on Stripe. Refer to Stripe’s Privacy Policy for further details.
Amazon Web ServicesInfrastructure in the EU (see above)Hosting, file storage, and backups
Servers, file storage, and backups for the FlowHunt Service. AI model processing through Amazon Bedrock is described separately below.
Google Cloud PlatformInfrastructure in the EU (see above)Embeddings and data warehouse
Google Vertex AI embeddings and Google BigQuery, as described above.
Mailchimp Transactional (Mandrill, an Intuit service)United StatesTransactional email
Sends service emails such as account and workspace notifications, and the emails that your flows send with the notification email step. Receives recipient email addresses and email content. Privacy Policy
Google LLCUnited StatesWebsite analytics & attribution
Google Analytics 4 (website analytics), Google Ads Enhanced Conversions (hashed email for conversion measurement), Google BigQuery (data warehouse for internal analytics). EU–US Data Privacy Framework. This processing concerns visitors and registered users of FlowHunt, not data obtained from Google integrations you connect.
Meta Platforms, Inc.United StatesAdvertising measurement
Meta Conversions API — hashed email transmission for advertising effectiveness measurement. EU–US Data Privacy Framework.
Stape, Inc.United StatesServer-side tag management
Routes analytics and conversion signals to authorised platforms on AiMingle’s behalf. Does not use data for own purposes. Data Processing Agreement in place.

Service-specific Subprocessors (AI and data providers)

FlowHunt uses the following service-specific subprocessors to provide its Service. Some of them are used automatically by FlowHunt features, by default settings, or by routing rules, including fallback to another provider; others are used only when you select a model, step, or tool. The table lists the company that actually receives the data. Where a provider routes requests to model providers, the downstream recipients are described in the same row. Provider retention and deletion conditions vary by service and configuration; processing a request is distinct from using its content for model training. See AI Service Providers in our Privacy Policy for how models are chosen.

ProviderPurpose and dataWhen it is usedLocation and terms
Amazon Web Services (Amazon Bedrock)Processes Anthropic Claude models, GPT-OSS models, and Amazon Nova models. Receives prompts, instructions, conversation history, and context, which may include knowledge source content, tool results, and data from connected platforms such as Google.
Also processes the flow assistant that helps you build flows. This is separate from the hosting and storage described above.
When a model served through Amazon Bedrock is selected, is the workspace or step default, or is used as a fallback; automatically for the flow assistant.EU (eu-central-1, Frankfurt, using EU cross-region inference). Amazon Bedrock data protection , AWS Data Processing Addendum
Anthropic, PBCProcesses Claude models that are not served through Amazon Bedrock, and Claude models when Bedrock is unavailable or disabled for a model. Receives prompts, instructions, conversation history, and context.When such a Claude model is selected, is a default or fallback, or is chosen by a “FlowHunt Auto” option through OpenRouter (see below).United States. Privacy Policy , Data Processing Addendum
OpenAIProcesses OpenAI models, including the default model of the AI agent step when no workspace default is set, and the fallback model of the classification step. Receives prompts, instructions, conversation history, and context.
Also transcribes uploaded audio and video files (Whisper), reads scanned PDF pages as images when text recognition (OCR) is enabled, generates images with OpenAI image models (including session image attachments used as references), and receives campaign data you send through the OpenAI Ads integration.
When an OpenAI model is selected, is a default or fallback, or generates images; automatically for audio and video transcription and enabled OCR.United States. Privacy Policy , Data Processing Addendum
Google (Gemini API)Processes Google Gemini models. Receives prompts, instructions, conversation history, and context.When a Gemini model is selected, is a default, or is used as a fallback.Gemini API Additional Terms , Privacy Policy
Mistral AI SASProcesses Mistral models through the Mistral API (console.mistral.ai). Receives prompts, instructions, conversation history, and context.When a Mistral model is selected, is a default, or is used as a fallback.France (EU). Privacy Policy , Data Processing Addendum
Google Cloud Platform (Vertex AI)Generates embeddings of knowledge source content and documents (see the infrastructure table above).Automatically, when content is added to a knowledge source or document store.EU (europe-west3, Frankfurt). Data Processing Addendum
OpenRouter, Inc.Routes requests to AI model providers. Used for open-weight and third-party models such as DeepSeek, Qwen, GLM (Z.ai), MiniMax, and MiMo, for the “FlowHunt Auto” options, and as a route to TypeSafe for classification. Receives prompts, instructions, conversation history, and context.
The downstream recipient depends on OpenRouter’s routing for the model, and may be the model developer (for example DeepSeek, Alibaba, Z.ai, MiniMax, Google, OpenAI, or Anthropic) or another inference provider hosting the model (for example DeepInfra or Novita). For the “FlowHunt Auto” options, FlowHunt asks OpenRouter to use only inference providers that do not collect request data.
When such a model or a “FlowHunt Auto” option is selected, is a default, or is used as a fallback.United States. Terms (section 10.2 incorporates the Data Processing Agreement for business use), Privacy Policy
ReplicateGenerates images, and in the PhotomaticAI app also videos, with models from developers such as Black Forest Labs, Google, ByteDance, Kling, Ideogram, Recraft, Luma, Runway, Stability AI, MiniMax, Alibaba, Tencent, and xAI. Receives image prompts and reference images, which can include image attachments in the session.When the image generation step or the PhotomaticAI app uses a model served by Replicate.United States. Privacy Policy
SerperGoogle search results for the search step. Receives search queries.When a flow uses the Google search step.Privacy Policy
DataForSEO OÜKeyword, ranking, search, and backlink data for SEO and DataForSEO steps. Receives keywords, domains, and URLs.When a flow uses these steps.Estonia. Privacy Policy
Oxylabs, UABProxy network used to fetch YouTube transcripts and, when needed, web pages, screenshots, and videos. Requests, including the requested URLs, pass through its network.Automatically for YouTube transcripts; when needed for crawling web pages added to knowledge sources, screenshots, and video downloads.Lithuania. Privacy Policy
Platforms you connectGoogle, Microsoft, Slack, Meta, Instagram, TikTok, Shopify, HubSpot, and the other integrations listed in the Privacy Policy. FlowHunt reads data from these platforms and performs the actions your flows request.Only when you connect the platform and a flow, tool, or trigger uses it.See the Privacy Policy for how connected platform data, including Google user data , is handled.

Search and research tools that you add to a flow, such as DuckDuckGo, Wikipedia, arXiv, PubMed, Stack Exchange, Reddit, Yahoo Finance, and YouTube search, receive the search query that the flow sends to them.

Subcontractors

To ensure 24/7 customer service availability, FlowHunt works with subcontractors, who may access Service Data. All subcontractors have contracts in place and must follow security guidelines one of which is accessing such data only with prior consent of the Customer.

Ready to build your own AI?

Smart Chatbots and AI tools under one roof. Connect intuitive blocks to turn your ideas into automated Flows.