O

Ory Corp

Ory provides secure, friction-free identity and access management for customers, partners, machines, and agents.

vendor	purpose	evidence
G Google Ireland Limited Ireland, USA	Ad personalization, remarketing	“DoubleClick / Google Ads Provider: Google Ireland Ltd. Purpose: Ad personalization, remarketing Legal Basis: Art. 6(1)(a) GDPR Transfer: USA, under Data Privacy Framework (DPF) Retention: Up to 540 days” source
H HubSpot, Inc. USA	Customer engagement, automated support, conversation analytics	“HubSpot AI Chatbot Provider: HubSpot, Inc., Cambridge, MA, USA Purpose: Customer engagement, automated support, conversation analytics Legal Basis: Art. 6(1)(a) GDPR Data: IP address, conversation logs, device information, user identifiers Transfer: USA via SCCs and Data Privacy Framework (DPF) Retention: As long as legitimate business need exists; immediate deletion by AI providers” source
K Kapa.ai Dover, Delaware 19904, United States	Process personal data for customer service requests and user-friendliness improvements	“We collaborate with Kapa.ai (kapa.ai Inc., 1111B S Governors Ave. #6248, Dover, Delaware 19904, United States). We rely on the services of the intelligent AI assistant to process customer service requests in an optimized and automated manner and to improve our user-friendliness. Through this collaboration, personal data is transmitted and processed.” source
L LinkedIn Ireland Unlimited Company Ireland, USA	Embeds, share buttons, social tracking	“LinkedIn Provider: LinkedIn Ireland Unlimited Company, Dublin, Ireland Purpose: Embeds, share buttons, social tracking Legal Basis: Art. 6(1)(a) GDPR Data: IP address, interaction data, LinkedIn ID (if logged in) Transfer: USA, protected by Standard Contractual Clauses (SCCs) Retention: As per LinkedIn’s policy” source
P PostHog Frankfurt, Germany	Analyze website usage, compile reports, provide services related to website and internet usage, conduct surveys	“PostHog processes this data on our behalf for these purposes.” source
R Reddit USA	Social sharing features	“Reddit Provider: Reddit Inc., San Francisco, CA, USA Purpose: Social sharing features Legal Basis: Art. 6(1)(a) GDPR Transfer: USA via SCCs Retention: According to Reddit’s policies” source
S Sanity AS Norway	Content hosting and delivery	“Sanity.io Provider: Sanity AS, Oslo, Norway Purpose: Content hosting and delivery Legal Basis: Art. 6(1)(f) GDPR (legitimate interest) Transfer: Typically within EEA; fallback SCCs Retention: Limited to technical logs” source

• G

  Google Ireland Limited

  Ireland, USA

  Ad personalization, remarketing

  “DoubleClick / Google Ads Provider: Google Ireland Ltd. Purpose: Ad personalization, remarketing Legal Basis: Art. 6(1)(a) GDPR Transfer: USA, under Data Privacy Framework (DPF) Retention: Up to 540 days” source

• H

  HubSpot, Inc.

  USA

  Customer engagement, automated support, conversation analytics

  “HubSpot AI Chatbot Provider: HubSpot, Inc., Cambridge, MA, USA Purpose: Customer engagement, automated support, conversation analytics Legal Basis: Art. 6(1)(a) GDPR Data: IP address, conversation logs, device information, user identifiers Transfer: USA via SCCs and Data Privacy Framework (DPF) Retention: As long as legitimate business need exists; immediate deletion by AI providers” source

• K

  Kapa.ai

  Dover, Delaware 19904, United States

  Process personal data for customer service requests and user-friendliness improvements

  “We collaborate with Kapa.ai (kapa.ai Inc., 1111B S Governors Ave. #6248, Dover, Delaware 19904, United States). We rely on the services of the intelligent AI assistant to process customer service requests in an optimized and automated manner and to improve our user-friendliness. Through this collaboration, personal data is transmitted and processed.” source

• L

  LinkedIn Ireland Unlimited Company

  Ireland, USA

  Embeds, share buttons, social tracking

  “LinkedIn Provider: LinkedIn Ireland Unlimited Company, Dublin, Ireland Purpose: Embeds, share buttons, social tracking Legal Basis: Art. 6(1)(a) GDPR Data: IP address, interaction data, LinkedIn ID (if logged in) Transfer: USA, protected by Standard Contractual Clauses (SCCs) Retention: As per LinkedIn’s policy” source

• P

  PostHog

  Frankfurt, Germany

  Analyze website usage, compile reports, provide services related to website and internet usage, conduct surveys

  “PostHog processes this data on our behalf for these purposes.” source

• R

  Reddit

  USA

  Social sharing features

  “Reddit Provider: Reddit Inc., San Francisco, CA, USA Purpose: Social sharing features Legal Basis: Art. 6(1)(a) GDPR Transfer: USA via SCCs Retention: According to Reddit’s policies” source

• S

  Sanity AS

  Norway

  Content hosting and delivery

  “Sanity.io Provider: Sanity AS, Oslo, Norway Purpose: Content hosting and delivery Legal Basis: Art. 6(1)(f) GDPR (legitimate interest) Transfer: Typically within EEA; fallback SCCs Retention: Limited to technical logs” source