This page lists the third parties Coretas, Inc. uses to help provide the Coretas platform, and which may process customer data on our behalf. It is referenced by our Data Processing Addendum and the Privacy Statement.
Every subprocessor is bound by a written agreement that limits its use of the data to providing services to us, and requires security measures appropriate to the data.
Platform infrastructure
| Subprocessor | Purpose | Data processed | Region |
|---|---|---|---|
| Amazon Web Services, Inc. | Application hosting | Customer advertising data, account data | United States, European Union, United Kingdom |
| Amazon Web Services, Inc. | Data storage | Customer advertising data, account data | United States, European Union, United Kingdom |
| Netlify, Inc. | Marketing site hosting and form handling | Contact details submitted through site forms | United States |
AI model providers
| Subprocessor | Purpose | Data processed | Region |
|---|---|---|---|
| OpenAI, L.L.C. | Generating analysis, recommendations, media plans, campaign components and Copilot responses | Advertising performance data and account metadata supplied as context with a request | United States, European Union, United Kingdom |
Under OpenAI's published API data policy, data sent through its API is not used to train or improve OpenAI's models unless the customer opts in, and we do not opt in. OpenAI may retain API inputs and outputs for up to 30 days for abuse monitoring before deleting them, unless it is legally required to keep them for longer. See the AI and Automation Policy for how your data is used as context and how long-term memory works.
Billing and payments
| Subprocessor | Purpose | Data processed | Region |
|---|---|---|---|
| Stripe, Inc. | Card payment processing, invoicing, subscription management | Billing contact details, payment method data held by the processor | United States |
Coretas does not store payment card numbers.
Communications and support
| Subprocessor | Purpose | Data processed | Region |
|---|---|---|---|
| Google LLC (Google Workspace) | Business email and documents | Contact details, correspondence | United States, European Union, United Kingdom |
| Google LLC (Google Workspace) | Product, account and transactional email | Name, email address | United States, European Union, United Kingdom |
| Slack Technologies, LLC | Customer support channels | Correspondence, anything shared in channel | United States |
Analytics and product usage
| Subprocessor | Purpose | Data processed | Region |
|---|---|---|---|
| Google LLC (Google Analytics 4) | Website and product usage analytics | Usage events, IP address, device and browser data | United States, European Union, United Kingdom |
| Google LLC (Google Tag Manager) | Tag management on the marketing site | Usage events | United States, European Union, United Kingdom |
We do not currently use a dedicated product analytics or session recording tool. We may add one, or add any other analytics, monitoring, error tracking, support, infrastructure or AI subprocessor, at any time and without prior notice, subject to the notice we give customers with an executed Data Processing Addendum under "Changes to this list" below. Analytics and advertising cookies are set only in line with the Cookie Notice.
Advertising platforms are not subprocessors
Google Ads and Meta Ads are independent third parties whose systems you connect to Coretas, and your relationship with them is governed by your own agreements with them. Coretas reads from and, with your approval, writes to those accounts on your instruction. See the Platform Connection and Data Access Policy.
International transfers
We and our subprocessors process data in the United States, the European Union and the United Kingdom, and data may be transferred between those locations. Where a transfer out of the EEA, the United Kingdom or Switzerland requires a transfer mechanism, we put a lawful one in place, which depending on the recipient and the transfer will be the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum or the UK Addendum to those Clauses, the Swiss addendum, an adequacy decision, or another mechanism permitted by applicable law. Those mechanisms are incorporated into our Data Processing Addendum, available from info@coretas.ai. We may change hosting locations, subprocessors and transfer mechanisms at any time and without prior notice, provided a lawful basis for the transfer remains in place. See section 7 of the Privacy Statement.
Changes to this list
We may add, replace or remove a subprocessor at any time, and we will update this page when we do. For customers with an executed Data Processing Addendum we give at least 30 days' notice by email before a new subprocessor starts processing customer data, so that you can object on reasonable data protection grounds. For everyone else the updated page is the notice, and a change takes effect as soon as we post it, without prior notice to you.
To receive those notices, email info@coretas.ai and ask to be added to the subprocessor notification list.
Changes to this policy
We may update this policy at any time. Unless the law, or an agreement we have signed with you, requires otherwise, a change takes effect as soon as we post it here, without prior notice to you, and the version on this page is the version that applies. We recommend checking this page from time to time. Prior versions are available on request from info@coretas.ai.
Material changes to the Terms of Use themselves follow the notice process in section 19 of those Terms.