Sub-processors
Last updated: 6 October 2026
Avaza Limited, a company incorporated in the Isle of Man, uses the third-party sub-processors listed below to help deliver the Avaza service. A sub-processor is a third party that may process personal data on behalf of our customers when it is needed to provide the service.
Some sub-processors are only used if you choose to enable the related feature. These are marked Optional feature below.
Current sub-processors
| Sub-processor | Purpose | Personal data | Location | Transfer safeguard |
|---|---|---|---|---|
| Amazon Web Services | Hosting, secure storage and processing of all Service data | All personal data entered into Avaza | United States (US regions only) | EU-US Data Privacy Framework and/or EU Standard Contractual Clauses |
| Intercom | Customer support | Email address, first name, last name and IP address of users who log in to Avaza | Republic of Ireland | Within EU/EEA |
| Chargebee | Avaza subscription processing and invoicing | Account owner's name, email address and billing address | United States | EU-US Data Privacy Framework and/or EU Standard Contractual Clauses |
| Braintree | Avaza subscription payments | Account owner's payment method | United Kingdom | UK adequacy decision (Article 45 GDPR) |
| Mailgun | Email communication | Email address, first name, last name | United States | EU-US Data Privacy Framework and/or EU Standard Contractual Clauses |
| Google Analytics | Usage analytics to help improve the product | Avaza usage information | United States | EU-US Data Privacy Framework and/or EU Standard Contractual Clauses |
| Storecove Optional feature |
E-invoice delivery, only if enabled by the customer | Invoice data, contact names, email addresses, addresses and tax IDs of invoice recipients | Netherlands | Within EU/EEA |
| OpenRouter, Inc. Optional feature |
AI gateway for AI Receipt Scanning, only if enabled by an account administrator. Routes requests to Google Gemini models on zero-data-retention endpoints. | Receipt and invoice files submitted to AI Receipt Scanning (including any personal data printed on them), plus the account's expense category, payment method and tax rate names | United States. The model provider's processing location is not fixed. | EU Standard Contractual Clauses and UK Addendum, as referenced in OpenRouter's published terms |
Changes to this list
We update this page when we add or replace a sub-processor. Customers who have signed our Data Processing Agreement are notified by email at least 30 days before a new or replacement sub-processor starts processing their data, and may object on reasonable grounds relating to the protection of personal data.
More information
For details of how we handle personal data, see our Privacy Policy and Terms and Conditions of Use. To request a copy of our Data Processing Agreement, visit our GDPR page.