1. About this list
These are the service providers and other organisations that receive or process personal data when you use VoltaAI. Hosting, storage, payment, SMS, email and verification providers are named. AI providers are listed by category and country, with transfer details.
The named list of AI providers is available on request from privacy@voltaservices.co.uk, or under a data processing agreement.
Most providers here are processors: they handle data on our instructions. Some are independent controllers: they decide for themselves how they use data, under their own privacy policies. The table says which.
2. Named providers
| Provider | Purpose | Personal data | Location | Role and safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH | Hosts our mail server and our search server | Mail server: every email we send you, such as verification and sign-in emails with their codes and links, multi-factor authentication codes and support replies. Search server: the web search queries written from your request | Germany | Processor. UK adequacy for the EU |
| Wasabi Technologies LLC | Storage for images and documents | Images you generate and documents you upload | Stored in the UK; company based in the USA | Processor. Standard contractual clauses with the UK Addendum for any access from the USA |
| Stripe | Card payments for subscriptions | Your email address, name and user ID, and the card details you enter on Stripe's page | Stripe Payments Europe, Ltd (Ireland); data processed by Stripe, LLC (USA) | Processor, under Stripe's data processing agreement. UK-US data bridge, with contract safeguards |
| GoCardless Ltd | Direct Debit payments | Your email address, first name, surname and user ID, and the bank details you enter on GoCardless's page | London, UK | Independent controller |
| Google Play billing | Purchases in our mobile app | Google Play handles the purchase. We receive the order reference, purchase token and your country | USA | Independent controller. UK-US data bridge |
| Vonage Business Limited | SMS sign-in codes | Your phone number and the code | UK company; processing in the UK, EEA and USA | Processor. Standard contractual clauses with the UK Addendum; US parent company on the UK-US data bridge |
| Postmark (AC PM LLC) | Receiving email replies to support tickets | The sender address, subject, body and attachments of your email replies | USA | Processor. UK-US data bridge through its parent company, with contract safeguards |
| StudID | Student verification through your university login | Your institution, affiliation and a pseudonymous identifier | Germany | Processor. UK adequacy for the EU |
3. AI providers
AI providers receive the content needed to answer your requests. Our AI governance page explains what they receive.
| Category | Used for | Location | Safeguard | Training on your content |
|---|---|---|---|---|
| AI model provider, EU (Estonia), with onward processing in the EEA and USA | Chat and images; writing web search queries and summarising results; reaching the embeddings provider; titles, summaries and image analysis when the US provider is unavailable | Estonia; onward to the EEA and USA | UK adequacy; the provider's own standard contractual clauses for onward transfers | Not without opt-in. Community providers it uses may differ |
| AI model provider, USA | Chat; first choice for titles, summaries and image analysis | USA | Being put in place. We have asked this provider to sign a data processing agreement that includes the UK International Data Transfer Addendum. Until it is signed, transfers on this route are not covered by a UK transfer safeguard | Not stated by the provider |
| AI model router, USA (free models) | Some free models | USA; onward to the providers serving each model | Standard contractual clauses with the UK Addendum | Not by the router itself. We ask the router to send requests only to providers that do not use your prompts for training |
| Image model provider, EU (Spain), for some image models | Image generation for some image models | Spain; onward to model hosts in adequate and non-adequate countries | UK adequacy; the provider's own standard contractual clauses with its model hosts for onward transfers | Not to train its own models. May use prompts for security and to improve its services |
| Embeddings provider | Making memory search copies of your messages, reached through the EU AI model provider | USA, with a fallback in Sweden | Onward transfer by the EU AI model provider; the provider is certified to the UK-US data bridge | Not used for training |
4. How long providers keep data
- Hetzner: as we decide, as the host of our mail and search servers.
- Wasabi: our application deletes stored files after 30 days.
- Stripe: while it provides its service to us, and afterwards as needed for legal, fraud prevention and tax purposes.
- GoCardless: as long as necessary, under its own privacy notice.
- Google Play billing: under Google Play's own policies.
- Vonage: SMS logs for up to 1 month and other records for 13 months.
- Postmark: message content for 45 days.
- StudID: verification sessions expire after 60 minutes. Other data is kept as long as required, under its own privacy policy.
- AI model provider, EU (Estonia): response caches for up to 30 days, and usage metadata for about 24 months.
- AI model provider, USA: keeps submitted content for abuse prevention, without stating a period, and keeps logs.
- AI model router, USA: does not store prompts unless the account opts in, and keeps metadata about requests. We ask our AI model router to send requests only to providers that do not use your prompts for training.
- Image model provider, EU (Spain): prompts and outputs for the term of its contract; its model hosts keep them for up to 30 days.
- Embeddings provider: abuse monitoring in the region where it processes the data.
5. Other services
- Domain name system: Cloudflare runs our domain name system (DNS). It does not carry traffic to the site.
- Email we send: we send email through our own mail server, hosted by Hetzner in Germany (see the named providers above). We do not use an email sending service.
6. Services we run ourselves
We run the VoltaAI service, its database, cache and memory components ourselves, on our own servers in the UK. We also run our own code runner and web page reader, and our own mail server and search server, which Hetzner hosts in Germany. Apart from Hetzner's hosting of the mail and search servers, none of these is provided by a third party.
The VoltaServices billing portal is also run by us, VoltaServices Limited. It can create and update VoltaAI accounts and API keys through our systems.
Running a component ourselves does not mean that no data leaves our servers. Our search server sends web search queries to public web search engines, some of them in the USA. The search engines receive the query text, but not your account details or your IP address. Memory search copies are made with the embeddings provider listed above. When our stored-facts memory component builds its store, it sends the text of your messages to an AI model provider, listed under AI providers above, to extract facts and make embeddings.
7. Getting the named list of AI providers
To get the names of our AI providers, write to privacy@voltaservices.co.uk. If you use our API, we offer a data processing agreement on request, and its list of sub-processors names them.
8. Changes to this list
When we add or replace a provider, we update this page and the date at the top. If you have a data processing agreement with us, we give you notice of changes as that agreement sets out.