This page lists the outside companies that can receive personal data when ТОВ «АПРИКОД» (APRICODE LLC, “Apricode”, “we”) provides APROS. It is part of our Data Processing Addendum and supports our Privacy Policy.
It has three parts:
- Sub-processors: companies we engage to provide APROS.
- Payment provider: the bank that takes payment for APROS subscriptions.
- Services a workspace connects: services a customer chooses to connect to its own workspace. These are the customer’s own providers, not our sub-processors.
What we run ourselves
Most of APROS runs on servers that Apricode operates itself, rented from Hetzner in Germany. The following are part of our own infrastructure, so they are not separate sub-processors:
- the application instance and database of each workspace;
- file storage;
- the integration service at
auth.apros.app, which connects Google and Meta accounts and routes Meta webhooks; - the AI gateway that passes requests to AI providers, and the default embedding model used for search;
- the video-call server and the AI call-coach worker;
- the document editor;
- the real-time messaging server;
- the code sandbox and the browser used by AI agents;
- the control plane that creates workspaces and handles subscriptions.
Some of these services are shared by all workspaces and keep each workspace apart with its own keys, storage buckets or access scopes. The Security page explains how.
Sub-processors
The last column says whether a company receives data from every workspace or only when a feature is used.
| Company | What it does for APROS | Personal data it can receive | Company location | When |
|---|---|---|---|---|
| Hetzner Online GmbH | Servers and storage for all of APROS | All data stored in APROS | Germany (data centres in Nuremberg and Falkenstein) | Always |
| Cloudflare, Inc. | Hosts this website and stores waitlist sign-ups in a Cloudflare D1 database. DNS for apros.app. Network proxy for the online checkout at buy.apros.app, the control plane and the status page |
Waitlist sign-ups (see Waitlist). Details entered at the online checkout, which pass through Cloudflare’s network. IP address and browser details of visitors to those addresses | United States (global network). Waitlist database: Cloudflare’s network, with the primary database location in Western Europe | Always |
| Microsoft Corporation (Azure AI Foundry, Azure OpenAI) | Language models, speech-to-text and image generation for APROS AI features, reached through our AI gateway. Embeddings only if a workspace chooses an Azure embedding model | The content an AI feature works on. This can include messages from every channel (including Messenger, Instagram and WhatsApp), emails, calendar events, documents, CRM records, voice notes and call recordings | United States. The Azure region is chosen by Apricode and may be outside the EEA | Whenever AI Brain or another AI feature is used, in any workspace, and when a crash report is processed |
| Deepgram, Inc. | Live speech-to-text for the AI call coach | The audio of every participant in a video call that the coach joins. Deepgram’s model improvement programme applies to this audio (see the Privacy Policy) | United States | When the call coach joins a call. The coach is switched on in new workspaces by default |
| OpenAI | Language model for the AI call coach. Backup model access, where configured | Live call transcripts, and the CRM details of the contact, lead, deal or company that the coach looks up. The content of an AI request, if a backup model is used | United States | When the call coach runs. Backup use depends on configuration |
| Jina AI GmbH (part of Elastic) | Reads web pages for AI agents | Addresses (URLs) of the pages an agent reads, which can contain names | Germany | When an AI agent reads a web page |
| Serper | Web search for AI research | Search queries written by an AI agent, which can include names of people or companies | Not confirmed; treat as outside the EEA | When an AI agent searches the web with our search key |
| 650 Industries, Inc. (Expo), relaying to Apple and Google | Push notifications to APROS mobile apps | Device token. Notification title, which can contain a person’s name. The text of chat messages and comments is replaced with a placeholder | United States | When a user registers a mobile device |
| Resend | Backup sender for staff notification emails | Recipient’s email address. Notification text, which can include a short preview of a customer’s message | United States | Only when a workspace has no mailbox of its own connected and this backup is enabled |
| Telegram | Our notification bot, used when a workspace has no notification bot of its own | Notification text sent to staff who linked their Telegram account, which can include a preview of a customer’s message | Not confirmed; treat as outside the EEA | Only when a user links Telegram for notifications |
| Google LLC (Google Fonts) | Fonts on the Meta connection pages at auth.apros.app, and in AI-generated proposal presentations and other AI-generated HTML designs |
IP address and browser details of the person viewing the page | United States | When those pages are opened |
Operator of react-circle-flags.pages.dev (the author of the open-source react-circle-flags library, hosted on Cloudflare Pages) |
Country-flag images shown in the app | IP address and browser details of app users when a flag image loads | Not confirmed; treat as outside the EEA | When the app shows a country flag |
| QuickChart | Chart images inside generated documents | Chart labels and values | Not confirmed; treat as outside the EEA | Only if we enable it. It is off by default |
Sub-processors without a data-processing contract
We have no data-processing contract with these sub-processors: Telegram, Serper, Jina AI, Google for Google Fonts, the operator of react-circle-flags.pages.dev, and QuickChart. They process the data listed above under their own public terms, if any. Deepgram’s model improvement programme applies to call-coach audio, so Deepgram does not process that audio only for us.
Payment provider
| Company | What it does | Personal data it receives | Location | When |
|---|---|---|---|---|
| JSC Universal Bank (monobank) | Takes card payments for APROS subscriptions and charges them in Ukrainian hryvnia | The details you enter on its payment page, and the amount and reference of the payment | Ukraine | When you pay for a subscription |
monobank processes payments as a bank under its own rules, not on our instructions. We receive the result of the payment, not your full card details.
Services a workspace connects
When a customer connects one of these services, data moves between that service and the customer’s workspace because the customer chose to use it. The service acts under its own terms with the customer or its users. We do not choose these providers, and they are not our sub-processors.
| Service | What moves |
|---|---|
| Meta: Facebook Messenger, Instagram, WhatsApp (where available) | Messages, attachments, names and profile photos of people who write to the connected Page, account or number, and the replies the business sends. The Meta connection page loads Meta’s JavaScript SDK. See Data from Meta platforms |
| Google: Gmail and Google Calendar | Mail and calendar events of the connected account, and the mail and events the user sends from APROS. See Google user data |
| The workspace’s own Telegram and Viber bots | Messages, names, usernames, profile photos and shared contacts of people who write to the bot |
| The workspace’s own mail server (IMAP and SMTP, for example Outlook) | Mail of the connected mailbox, and staff notification emails |
| Bank statement import: monobank personal API, PrivatBank (Privat24 Autoclient) | Transactions, including counterparty names and payment details |
| Payment links for the workspace’s own invoices: monobank acquiring, Stripe, NOWPayments | Invoice number and amount. Payers enter their card details on the provider’s own form |
| WooCommerce store | Products, categories, attributes and stock |
| GitLab | Project names, branches, commit and merge-request details |
| AI clients connected to APROS as an MCP server (for example ChatGPT, Claude or Cursor) | Whatever workspace data the user allows the client to read |
| External MCP servers, webhooks and calendar feeds set up by the workspace | The data the workspace configures to send |
| Claude Code connector | Tasks and messages the user sends to Claude Code, which runs under the customer’s own Anthropic account |
| The workspace’s phone system | Call details and recordings that the phone system passes to APROS |
| AI or search providers used with the workspace’s own API key | The content of the requests made with that key |
Changes to this list
We email the account owner of every workspace at least 30 days before a new sub-processor starts processing Customer Data, and update this page, with its “Last updated” date, at the same time. A customer may object to a new sub-processor as described in the Data Processing Addendum.
Questions about this list: hello@apri-code.com.
Language versions
This document is published in Ukrainian and English, and both versions have the same content. If they differ, the Ukrainian version prevails. This does not limit any right you have under the law that applies to you.