Subprocessors

As a Data Processor under the GDPR, UK GDPR, India’s DPDP Act, and the CCPA/CPRA, we engage third-party infrastructure and foundation-model providers. Each is bound by data-protection terms and each is listed here before it begins processing personal data. This page forms part of our Data Processing Agreement.

Directory version: v2026.10 ·
Last substantive review: 20 October 2026 ·
All subprocessors in good standing

In accordance with Clause 9 of the EU Standard Contractual Clauses and our DPA, we give customers at least thirty (30) calendar days’ advance written notice before authorising a new subprocessor. You may object on reasonable data-protection grounds within fourteen (14) days of notice by writing to privacy@bizplanaipro.com.

Foundation model providers

Providers supplying machine-learning inference for plan generation, idea analysis, and coaching responses.

Subprocessor	Purpose / models	Training on API data	Processing location	Compliance (provider-published)
Groq, Inc.Primary inference AI	Primary generation path. Currently serves `openai/gpt-oss-120b`.	No training on API data Per Groq Cloud API terms	United States	SOC 2 Type II — per provider trust center. Evidence available on request.
OpenAI, L.L.C.Fallback inference AI	Fallback generation when the primary provider fails or is unavailable. Serves `gpt-4o-mini`, then `gpt-4o` as last resort.	No training on API data Per OpenAI API terms: API data is not used to train models	United States	SOC 2 Type 2, ISO/IEC 27001 — per provider trust center.

Payments and billing

Both processors operate hosted checkout. Card and bank credentials are captured on their infrastructure and never reach our servers.

Subprocessor	Purpose	Training on API data	Processing location	Compliance (provider-published)
PolarPrimary payments & licence provisioning payment	Order processing, subscription state, tax calculation, licence issuance. Card data entered on Polar’s hosted checkout.	N/A — no model inference	United States	PCI DSS (as a payments provider) — per provider trust center.
Cashfree PaymentsPayments for Indian customers payment	Order processing and payment-method capture for customers paying in INR, including UPI and Indian cards.	N/A — no model inference	India	PCI DSS Level 1, ISO/IEC 27001 — per provider trust center.

Infrastructure, identity and tooling

Subprocessor	Purpose	Training on API data	Processing location	Compliance (provider-published)
Google LLCIdentity, tags, fonts, search infra	Sign-in with Google; Google Tag Manager; web-font delivery; Search Console performance reporting.	N/A — no model inference	United States	SOC 1/2/3, ISO/IEC 27001, 27017, 27018 — per provider trust center.
CookieYesConsent management infra	Cookie consent capture and consent-record storage to evidence your choices.	N/A — no model inference	India / United Kingdom	See provider trust center; evidence available on request.
Cloudflare, Inc.CDN for static assets (cdnjs) infra	Delivery of shared front-end library files from the cdnjs CDN.	N/A — no model inference	Global edge network	SOC 2 Type II, ISO/IEC 27001 — per provider trust center.

On certifications: those listed are as published by each provider at the review date above. We do not independently audit our subprocessors’ certifications; where a customer needs evidence for a vendor register, we will supply the provider’s current report or trust-center reference on request.

Processing locations are as published by each provider and are re-checked at every scheduled review — the date at the top of this page tells you when that last happened. If you need written confirmation of the processing region for a specific provider, write to privacy@bizplanaipro.com and we will confirm it against their current documentation. This list covers every third party we engage to deliver the Service; our mail server, hosting and analytics are operated by us directly and are not shared with a processor.

What is not on this list, and why

Our mail server — outbound email leaves through mail.bizplanaipro.com, which we operate. Your email address is not passed to a third-party email provider.
Our hosting — the application, database, and website run on infrastructure we administer directly. The hosting operator has physical access to the machine but is not given access to application data.
Our own analytics — visitor measurement runs on our own domain, not a third-party analytics service.
Directory listings — G2, Capterra, Product Hunt, and GoodFirms list our product and receive no customer data from us.

Change log

Every substantive change to this directory increments the version and adds a row here. Customers relying on our DPA may request email notice of changes.

Version	Date	Change
v2026.10	20 Oct 2026	Directory published. Grouped by function; added training-policy and location columns.

Objecting to a subprocessor

Where our DPA applies, you may object to a new or replacement subprocessor on reasonable data-protection grounds within fourteen days of notice. If we cannot resolve the objection, you may terminate the affected Services and receive a pro-rata refund of prepaid fees.