ANTARES · Legal
Sub-processors
This is the list the Privacy Notice refers to. It names every third party that receives personal data on our behalf when ANTARES runs, says in one line what each of them does with it, and states where the processing happens as our configuration sets it. It is generated from the same declaration our own engineers keep, so it cannot list a provider the product does not use, or omit one it does.
Infrastructure and operations
The services that run ANTARES itself: hosting, the database, storage, the network in front of it, rate limiting, email and payment.
| Service | Legal entity | Role | Processing location | When |
|---|---|---|---|---|
| Amazon Web Services | Amazon Web Services EMEA SARLIts own sub-processors | Runs the application and its workers, hosts the managed PostgreSQL database, stores generated images, video and CAD artefacts, and holds the service logs from which we diagnose failures.In law: Our processor: acts on our instructions only. | European Union: eu-central-1 (Frankfurt) for the application and the database, eu-north-1 (Stockholm) for the object-storage bucket. | AWS Europe is the contracting party whenever the account's tax address is in one of the listed EMEA countries, Italy included. The entity is registered at 38 Avenue John F. Kennedy, L-1855 Luxembourg (RCS Luxembourg B186284). |
| Cloudflare | Cloudflare, Inc.Its own sub-processors | Carries every request to our servers and terminates the TLS connection, so it sees requests and responses in clear while they are in transit; filters hostile traffic and absorbs denial-of-service attacks. Cloudflare Access additionally verifies administrators before they reach the administration console.In law: Our processor: acts on our instructions only. | Worldwide network: the connection is terminated at the data centre closest to the person making the request, which may be outside the European Economic Area. | The United States parent is the counterparty on a self-serve account, in the European Economic Area as elsewhere; an Irish counterparty arises only under an Enterprise order form. Transfers outside the European Economic Area rest on the standard contractual clauses and on the provider's Data Privacy Framework certification. |
| Upstash | Upstash, Inc.Its own sub-processors | Hosted Redis holding the counters that enforce rate limits. It stores a counter per key and its expiry, not the content of a request.In law: Our processor: acts on our instructions only. | To be confirmed | — |
| To be confirmed | To be confirmedIts own sub-processor list: to be confirmed. | Delivers transactional email: address verification, password reset, billing and security notices. It receives the recipient address and the body of the message.In law: Our processor: acts on our instructions only. | To be confirmed | — |
| Stripe | Stripe Payments Europe, LimitedIts own sub-processors | Takes payment, runs subscriptions and invoicing and sends us the resulting events. Card details are entered on Stripe's own pages: we never receive the full card number. Stripe is our processor for the payment we instruct and, at the same time, an independent controller of the same data for fraud prevention, anti-money-laundering and the other regulatory duties it is subject to: for that part it acts on its own account, not on ours.In law: Our processor for what we instruct, and an independent controller of the same data for its own regulatory purposes. | To be confirmed | An account established in the European Economic Area contracts with Stripe Payments Europe, Limited, of Dublin, Ireland. |
Artificial intelligence providers
The providers that receive the content of a request in order to produce a response. Which one serves a request depends on the model you or the automatic router selected, and the interface tells you which it was wherever we are able to. A model whose weights are served by somebody else — on Amazon Bedrock, by Mistral, or by a European host we name here — is not listed separately, because no data reaches its vendor.
| Service | Legal entity | Role | Processing location | When |
|---|---|---|---|---|
| OpenAI | OpenAI Ireland Ltd.Its own sub-processors | Receives the content of a request routed to an OpenAI model, and produces the response. It also runs the automated safety check applied to prompts and outputs, and, where you use them, speech synthesis, transcription and the real-time voice session.In law: Our processor: acts on our instructions only. | United States (global endpoint); EU processing is available but only where the project is configured for it. | A customer in the European Economic Area or Switzerland contracts with OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. |
| Anthropic | Anthropic Ireland, LimitedIts own sub-processors | Receives the content of a request routed to a Claude model, and produces the response.In law: Our processor: acts on our instructions only. | Global: traffic may be routed to the United States, Europe, Asia or Australia; data is stored in the United States. | A customer in the European Economic Area, Switzerland or the United Kingdom contracts with Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland. |
| Google (Gemini API)Not currently in use | Google Cloud Italy S.r.l.Its own sub-processors | Receives the content of a request routed to a Gemini model, and produces the response.In law: Our processor: acts on our instructions only. | Not established: Google publishes no data-residency commitment for the Gemini Developer API endpoint; processing takes place on Google's global infrastructure. | The configuration does not allow this recipient to receive anything: the contract, the transfer mechanism or the terms required before it may be used are not recorded. Nothing reaches it while that is so. |
| xAI (SpaceXAI) | SpaceXAI LLCIts own sub-processors | Receives the content of a request routed to a Grok model, and produces the response, including the images and video generated with Grok Imagine.In law: Our processor: acts on our instructions only. | United States and other countries where the provider and its sub-processors operate; no EU residency is offered. | The entity has been renamed: the terms and the data processing addendum currently in force (August 2026) are published under the name SpaceXAI LLC. No registered address is published, so none is given here. |
| Mistral AI | Mistral AIIts own sub-processors | Receives the content of a request routed to a Mistral model, and produces the response. The Z.ai GLM model offered in ANTARES is hosted by Mistral, so using it opens no separate route to Z.ai.In law: Our processor: acts on our instructions only. | To be confirmed | A French société par actions simplifiée registered in Paris under number 952 418 325, 15 rue des Halles, 75001 Paris, France. The provider publishes no region commitment: it says it prioritises providers in the European Union but that, in exceptional cases, it may opt for providers outside it. |
| Alibaba Cloud Model Studio (Qwen)Not currently in use | Alibaba (Netherlands) B.V.Its own sub-processor list: to be confirmed. | Receives the content of a request routed to a Qwen model, and produces the response.In law: Our processor: acts on our instructions only. | Germany (Frankfurt) for storage; inference runs within the deployment scope configured on the workspace, which must be set to the EU for processing to remain in the European Economic Area. | The configuration does not allow this recipient to receive anything: the contract, the transfer mechanism or the terms required before it may be used are not recorded. Nothing reaches it while that is so. |
| Amazon Bedrock | Amazon Web Services EMEA SARLIts own sub-processors | Serves third-party open models (NVIDIA Nemotron, Moonshot Kimi, Qwen, Mistral) on AWS hardware. The request reaches AWS and no one else: the vendors of those models receive nothing.In law: Our processor: acts on our instructions only. | European Union: eu-north-1 (Stockholm) by default, eu-south-1 (Milan) for the models the catalogue places there. | AWS Europe is the contracting party whenever the account's tax address is in one of the listed EMEA countries, Italy included. The entity is registered at 38 Avenue John F. Kennedy, L-1855 Luxembourg (RCS Luxembourg B186284). |
| OpenRouterNot currently in use | To be confirmedIts own sub-processor list: to be confirmed. | Forwards a request to the model vendor that serves the model you selected. Which vendor that is depends on the model, and OpenRouter sees the request on the way.In law: Our processor: acts on our instructions only. | To be confirmed | The configuration does not allow this recipient to receive anything: the contract, the transfer mechanism or the terms required before it may be used are not recorded. Nothing reaches it while that is so. |
| NVIDIA (NIM) | NVIDIA CorporationIts own sub-processor list: to be confirmed. | Receives the content of a request routed to a model served on NVIDIA's own hosted endpoints, and produces the response.In law: Our processor: acts on our instructions only. | Not established. Taken to be the United States unless confirmed otherwise: no data residency in the European Union is offered for the hosted NIM endpoint. | NVIDIA Corporation, 2788 San Tomas Expressway, Santa Clara, California 95051, USA. |
| Brave Search APINot currently in use | Brave Software, Inc.Its own sub-processors | Runs the web search behind a request that needs one. It receives the search query, which is derived from what you asked, and returns titles, links and short extracts of the pages it found. It keeps a record of the queries made through our account for at most 90 days, for billing and troubleshooting.In law: Our processor for what we instruct, and an independent controller of the same data for its own regulatory purposes. | United States. | The configuration does not allow this recipient to receive anything: the contract, the transfer mechanism or the terms required before it may be used are not recorded. Nothing reaches it while that is so. |
| TavilyNot currently in use | AlphaAI Technologies Inc.Its own sub-processor list: to be confirmed. | Runs the web search behind a request that needs one. It receives the search query, which is derived from what you asked.In law: Our processor: acts on our instructions only. | United States. | The configuration does not allow this recipient to receive anything: the contract, the transfer mechanism or the terms required before it may be used are not recorded. Nothing reaches it while that is so. |
Application platforms
Services reached only in a specific circumstance: a purchase made inside the Android application, an advertisement you consented to, a notification you asked for.
| Service | Legal entity | Role | Processing location | When |
|---|---|---|---|---|
| Google Play Billing | Google Commerce LimitedIts own sub-processors | Takes payment for a subscription bought inside the Android application and tells us its state. We receive a purchase identifier, never a payment instrument.In law: Our processor: acts on our instructions only. | To be confirmed | Only for subscriptions bought inside the Android application. Google Commerce Limited, 70 Sir John Rogerson's Quay, Dublin 2, D02 R296, Ireland, is the seller of record to the buyer in the European Economic Area; that is a statement about the sale to you, not about our own developer agreement, whose counterparty is not established here. |
| Apple App Store (In-App Purchase) | Apple Distribution International Ltd.Its own sub-processor list: to be confirmed. | Takes payment for a subscription bought inside the iOS application and tells us its state. We receive a purchase identifier and the account link token we generated, never a payment instrument and never the Apple ID.In law: Our processor: acts on our instructions only. | To be confirmed | Only for subscriptions bought inside the iOS application. Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, is the seller of record to the buyer in the European Economic Area; that is a statement about the sale to you, not about our own developer agreement, whose counterparty is not established here. |
| Google AdMob | Google Ireland LimitedIts own sub-processors | Selects and delivers the rewarded advertisements offered on the Free plan, and confirms to us that one was watched. Google is an independent controller of the ad-request data it receives, not our sub-processor: outside the separate "AdMob Processor features", it determines its own purposes for that data and answers for them itself.In law: Independent controller: determines its own purposes for what it receives, and answers for them itself. | To be confirmed | Only on the Free plan, only with your consent, and never on an account belonging to a user under 18. The counterparty is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland. |
| Expo push service | 650 Industries, Inc.Its own sub-processors | Delivers push notifications to the mobile application. It receives the device push token and the text of the notification, and hands both on to Apple (APNs) or Google (FCM), which stand behind it and carry the notification to the device: Expo's own sub-processor list names them.In law: Our processor: acts on our instructions only. | United States. | Only if you turn on notifications in the mobile application. 650 Industries, Inc., 624 University Ave FL1, Palo Alto, CA 94301, USA. |
| Web Push | To be confirmedIts own sub-processor list: to be confirmed. | Delivers web push notifications. The service is the one operated by the maker of the browser you use — Mozilla, Google and Apple each operate one, by way of example — and your browser, not ANTARES, chooses it. We have no agreement with any of them: the endpoint your browser hands us is the only address we hold.In law: No agreement with us: the service is chosen by your browser, not by ANTARES. | To be confirmed | Only after you grant the browser permission for notifications. |
01What this list is, and what it is not
A sub-processor is a third party that processes personal data on our instructions, for us. Listing one here is not a statement that it may do as it likes with your data: each is bound by a data processing agreement, and the transfer safeguards described in the Privacy Notice apply to any processing outside the European Economic Area.
Some artificial intelligence providers act as our processors and some act as independent controllers of the data they receive; the Privacy Notice sets out the distinction. They are all listed here because in either case the content of your request reaches them.
Where a field reads “To be confirmed”, the registered name or the processing location of that provider has not yet been established to our own standard of evidence, and we would rather say so than print something we cannot support. Those gaps are being closed and nothing else on the row depends on them.
A row marked “Not currently in use” names a recipient our configuration does not presently allow to receive anything, because the contract, the transfer mechanism or the terms it would have to be used under are not recorded. We keep such a row on the list rather than deleting it: a register that quietly drops a name cannot be checked against the one we published last month, and the recipient may be permitted again once what is missing is in place. Until then nothing reaches it.
Where a provider publishes its own sub-processor list, we link to it from its entity: who our provider passes your data to is part of what a list like this is for. Where the row instead says that list is to be confirmed, we have not established one to our own standard of evidence — for some of these providers because there is none to find, which is itself a reason we may not be using them.
02How it is kept up to date
The list is a declaration inside the ANTARES source code, not a page maintained by hand, and it is read by the page you are looking at. Adding a provider means changing that declaration, which is reviewed like any other change to the product.
We update this page before a material change takes effect, as the Privacy Notice says. If you object to a new sub-processor, write to us at the address below before the change takes effect.
03Questions and objections
Write to emtantares@emtaerospacetechnologies.com. Your rights, and how to exercise them, are described in the Privacy Notice; nothing on this page limits them.