Subprocessors and Service Providers
Subprocessors, operational roles, and infrastructure providers engaged across AWS, iyzico, Meta/WhatsApp, Google, and AI platforms.
Service Provider: EMRE ALAY — CREATO AI • Karşıyaka / İzmir
CREATO AI Subprocessors and Service Providers
Document version: 2.0 — Date of preparation: September 30, 2026.
1 Scope and legal roles
CREATO AI engages trusted third-party service providers commensurate with activated tiers, functional modules, and integration links. A subprocessor is a vendor processing personal data on behalf of CREATO AI within the scope of services delivered to Customer. Payment gateways or platforms connected directly by Customer may also act as independent data controllers for their own statutory objectives. Mention in this registry does not signify that a vendor acts as a subprocessor across all operational activities.
2 Categories of service providers
| Provider | Service and Data Scope | Role Determination |
|---|---|---|
| Amazon Web Services (AWS) | Cloud server and hosting infrastructure; account, customer content, and technical logs required for active features | Acts as a subprocessor to the extent it hosts Customer Data; roles regarding direct CREATO corporate administration are evaluated separately |
| iyzico | Payment collection, transaction results, refunds, billing reconciliation, and payment security | Independent data controller under financial legislation and for its own statutory purposes; not automatically a subprocessor for all operations |
| Meta and WhatsApp | Messaging infrastructure, template approvals, campaign statuses, ad metrics, and authorized lead forms | Evaluated according to channel terms and actual operational purposes; Customer's connected accounts and CREATO software flows are assessed separately |
| Google integrations activated by the user and disclosed on OAuth screens | Determined by relevant APIs and processing purposes; subject to Google Limited Use and Workspace developer restrictions | |
| Customer-connected Store Platform | Source connection for authorized product, order, contact, and sales performance data | Source selected independently by Customer; vendor agreement and data roles evaluated separately |
| Dedicated AI Language Model Provider | Truly anonymized operational inputs required strictly for activated language model capabilities | Purpose and channel restrictions enforced on anonymous inputs; workflows involving personal data are enabled only following separate disclosures and transfer safeguards |
The exact legal entity, hosting region, subprocessors, and data retention windows of a vendor depend on actual service configurations. Mention of AWS does not by itself imply that servers are located within a specific domestic territory. Operations by Meta, Google, or LLM providers are not presumed to take place in a single jurisdiction.
3 Account registry and disclosures
Vendors accessing personal data will be disclosed with their legal entity name, functional role, data categories, processing/remote access jurisdiction, data retention parameters, and applicable international transfer safeguards prior to feature deployment. Customers may request this registry via hello@creato.digital. An unannounced vendor or unspecified hosting jurisdiction does not grant blanket transfer authorization under this notice.
Using genuinely anonymized prompt inputs does not retroactively render prior raw data hosting or unanonymized background processing exempt from statutory data protection rules. Each phase of an international data flow is evaluated independently.
4 Updates and objection procedure
For new or replacement subprocessors accessing Customer Data, CREATO AI provides at least thirty days prior notice pursuant to the Data Processing Agreement. Customer may object within fifteen days on documented data protection grounds. The parties shall seek reasonable mitigations or alternatives. If an objection cannot be resolved, the affected module may be terminated without penalty to Customer, and unearned prepaid fees refunded. Emergency operational changes do not justify bypassing mandatory statutory transfer safeguards.
5 Safeguards and contact
Subprocessors are governed by enforceable contracts mandating strict access boundaries, confidentiality commitments, technical security, purpose limitations, and post-termination erasure. CREATO AI does not transfer its own vendor governance responsibilities onto the Customer. This notice does not represent unverified security certifications or incomplete standard contractual filings as fully executed.
Contact and notices: EMRE ALAY — CREATO AI, hello@creato.digital.
Have a Legal Question?
Contact us directly regarding contracts, data protection and rights requests.