Skip to content

Legal

Subprocessors

Last updated: May 2026

Toster (ADS L.L.C-FZ) uses the following third-party subprocessors to deliver the platform. We maintain Data Processing Agreements with each subprocessor and update this list at least 30 days before adding a new subprocessor. Customers who have signed a DPA may object to new subprocessors within that notice period.

Infrastructure & Hosting

NameRoleLocationTransfer mechanism
Railway Corp.Application hosting & deploymentUnited StatesSCC + DPF
Cloudflare, Inc.CDN, WAF, object storage (R2)GlobalSCC + DPF

Communications

NameRoleLocationTransfer mechanism
SendPulseEmail, SMS, push notification deliveryUnited StatesSCC
Telegram FZ-LLCBot API for operator, courier, kitchen, and customer botsUAEUAE PDPL (adequate protection)

Payments

NameRoleLocationTransfer mechanism
Stripe Payments Europe Ltd.Card payment processing (EU/UK)IrelandWithin EEA
LiqPay / PrivatBankPayment processing (Ukraine)UkraineSCC

AI Providers

NameRoleLocationTransfer mechanism
Anthropic PBCLarge language model API (Claude) for automation & analysisUnited StatesSCC + DPF
ElevenLabs, Inc.AI voice synthesis for conversational operatorUnited StatesSCC + DPF
Qdrant GmbHVector database for semantic searchGermanyWithin EEA

Analytics & Monitoring

NameRoleLocationTransfer mechanism
Axiom, Inc.Log aggregation and monitoring (PII redacted before ingestion)United StatesSCC + DPF
PostHog, Inc.Product analytics and session recordingUnited StatesSCC + DPF

Definitions

  • SCC — EU Standard Contractual Clauses (Commission Decision 2021/914)
  • DPF — EU–US Data Privacy Framework (adequacy decision, July 2023)
  • Within EEA — data does not leave the European Economic Area; no transfer mechanism needed
  • UAE PDPL — UAE Personal Data Protection Law; Telegram's UAE incorporation provides equivalent protection under our DPA

Questions about subprocessors: [email protected]