Subprocessors

^{Last updated: 02/09/2026}

To deliver the Service, Diglot OÜ uses a small number of carefully selected third-party providers (“subprocessors”) that may process personal data on our behalf. This page lists those subprocessors, what they do, where they are based, and what mechanism we rely on for any cross-border data transfer. It complements our Privacy Policy and our Data Processing Addendum (available to B2B / education customers on request at legal@diglot.ai).

We use, and continue to add, only the subprocessors strictly necessary to run the product. We require each one to provide appropriate technical and organisational safeguards, to act on documented instructions, to maintain confidentiality, and to allow audits as required by GDPR Art. 28.

Current subprocessors

Infrastructure and hosting

Generative AI providers

We send the relevant portion of your User Content (drafts, prompts, tool inputs) to these providers solely to produce the output you asked for. Our contracts prohibit them from using your User Content to train their general-purpose foundation models.

Two things about this table are worth saying plainly, because they are the parts a reader would otherwise get wrong.

A fallback provider is a real disclosure, not a hypothetical one. When the provider above it in the chain is unavailable, live traffic moves down automatically — so a fallback provider does receive your content, just less often.

The last two rows are listed even though they process nothing today. They remain configured, and the routing configuration is something we can change. Listing them means a change of ours cannot quietly send your content somewhere this page never named.

We may add a provider on 30 days’ prior notice — see Changes below. Which provider serves a given feature may rotate based on health, latency, and quality, in accordance with our routing configuration.

Last verified against the running system on 2 September 2026. We check this list against the live routing configuration, not against our own documentation, because the two drift apart — this table previously named three AI providers, two of which processed nothing while three that did were missing.

Billing and payments

We do not see or store your full payment-card number. We see only billing metadata such as transaction ID, plan, country, last 4 digits of the card, and the email used for billing.

Operational tools

Partner (affiliate) programme

If you arrive through a link published by one of our partners, we record that referral so the partner can be paid for it.

What Affonso receives from us: an opaque click identifier, the partner’s identifier, your e-mail address at sign-up, our internal user ID, and — for a paid subscription — the amount, currency and transaction ID. It receives your IP address and browser user-agent only if you accepted analytics/marketing cookies. It does not receive your documents, drafts, or any User Content.

| Refgrow | Affiliate-programme tracking, as an alternative to Affonso: records the referred visit, the sign-up, and the resulting payment | United States | EU SCCs |

What Refgrow receives from us: a referral code from the link you followed, and — if you open the partner dashboard inside the product — your e-mail address, which is what lets the dashboard show your own figures without a second login. Its script sets one cookie, refgrow_ref_code, for 30 days, and only after you accept marketing cookies.

Affonso and Refgrow do the same job and we do not run both at once: a visit is recorded by one of them, never by both. Which one is active is stated here whenever it changes.

Authentication and identity (where you choose to use them)

These providers receive only the minimum information needed to authenticate you (an opaque user ID and, depending on the method, your email).

Internal affiliates

If we engage internal Diglot affiliates (e.g., a future U.S. subsidiary for B2B sales), we will list them here too and bind them to the same data-protection terms.

Changes to this list

When we add a new subprocessor or replace an existing one, we will:

1. update this page (and bump the Last updated date at the top);
2. for B2B / education customers, give at least 30 days’ prior notice by email (using the contacts on file) so they have time to object;
3. for individual users, surface a notice in the product and / or in the cookie banner where the change affects analytics or cookies.

If you believe a subprocessor change creates a material privacy risk for you, you can terminate your subscription and delete your account before the change takes effect.

Contact

For questions about subprocessors, to receive a copy of the standard contractual clauses we rely on, or to request a copy of our Data Processing Addendum:

Diglot OÜ — Republic of Estonia legal@diglot.ai