Public legal documents
Aibo — Subprocessor List
Version: 1.2 Effective date: 16 July 2026 Provider / Platform Operator: Aibo Technologies (RUC 0924829179001) Registered address: 3er Cj 20A NorthEast, Guayaquil, Guayas, Ecuador 090502 Privacy contact: legal@aibotask.com
This Subprocessor List describes third parties that may process personal data on behalf of Customers (Tenants) when using Aibo, and key service providers that support Provider-controlled Aibo admin/commercial workflows where applicable.
1) Definitions (high level)
- Customer / Tenant (Data Controller): the company that configures and uses Aibo for its operations and determines purposes/means of processing.
- Provider (Data Processor): Aibo Technologies, which operates Aibo and processes Customer data only on documented instructions (see DPA).
- Provider-controlled platform data: certain records for Aibo Admin tenant provisioning, licensing, billing, support ticketing, security operations, and consented public-website analytics for which Aibo Technologies may act as Data Controller under the Privacy Policy.
- Subprocessor: a third party engaged by the Provider to support the delivery of the Service (e.g., cloud hosting, messaging).
2) How we update this list
We may update this list from time to time as we change vendors or add integrations. Material changes will be reflected here.
If you have questions or need prior notice mechanisms, contact: legal@aibotask.com.
3) Current subprocessors
3.1 Cloud infrastructure and core platform
| Subprocessor | Service | Purpose | Primary location/region |
|---|---|---|---|
| Amazon Web Services, Inc. (AWS) | Cloud hosting (compute, storage, databases) | Core infrastructure to run Aibo and store Customer data (work orders, photos, signatures, GPS routes, logs) | us-east-1 (N. Virginia, United States) |
3.2 Email delivery
| Subprocessor | Service | Purpose | Primary location/region |
|---|---|---|---|
| Amazon Web Services, Inc. (AWS) | Amazon Simple Email Service (SES) | Transactional email delivery (e.g., invitations, password resets, notifications, service reports) | us-east-1 (N. Virginia, United States) |
3.3 Push notifications
| Subprocessor | Service | Purpose | Notes |
|---|---|---|---|
| Amazon Web Services, Inc. (AWS) | Amazon Pinpoint | Sending push notifications (e.g., new job assigned, status updates) | Uses mobile platform push services below |
| Apple Inc. | APNs | Delivery of push notifications to iOS devices | Device OS dependent |
| Google LLC | FCM | Delivery of push notifications to Android devices | Device OS dependent |
3.4 Maps / geolocation services
| Subprocessor | Service | Purpose | Primary location/region |
|---|---|---|---|
| Amazon Web Services, Inc. (AWS) | AWS mapping/geolocation services (e.g., Amazon Location Service) | Display maps and geospatial features (where enabled) | us-east-1 (N. Virginia, United States) |
3.5 Web analytics / performance telemetry (Aibo Admin / provider web portals)
| Subprocessor | Service | Purpose | Primary location/region |
|---|---|---|---|
| Amazon Web Services, Inc. (AWS) | Amazon CloudWatch RUM | Measure Aibo Admin and related provider web-portal performance and usage telemetry to improve reliability and UX | us-east-1 (N. Virginia, United States) (telemetry storage per AWS configuration) |
3.6 Consented public-website analytics (Provider-controlled)
| Service provider / processor | Service | Purpose and limited data | Processing locations |
|---|---|---|---|
| Google LLC | Google Analytics 4 (GA4) | Optional public-marketing-site measurement after consent: pseudonymous client/session identifiers; page origin/path/title without query strings; referring-site origin; allowlisted source/medium; approved low-cardinality event metadata, including team-size-band and operation-type selections; approximate country/region derived by Google from the IP address while the request is in transit; and browser/device/technical information. Google Analytics does not log or store the IP address | United States and other locations where Google operates, subject to applicable contractual transfer safeguards |
This GA4 implementation does not receive free-text form fields, names, company names, contact details, messages, payment references, account/user/tenant/internal IDs, raw errors, advertising-platform click identifiers, or utm_campaign/utm_content/utm_term values. It may receive only the allowlisted low-cardinality team-size-band and operation-type selections described above. Granular location/device-data collection, Google Signals, Google Ads linking/advertising personalization, and Enhanced Measurement are disabled. Event-level and user-level data used in Explorations and funnel reports is configured for 2 months; that control does not affect standard aggregated reports, and Google deletes covered user/event data monthly after the retention period. First-party GA4 cookies expire after at most 180 days without rolling renewal.
3.7 Payments (Aibo Admin subscription transactions)
| Subprocessor | Service | Purpose | Notes |
|---|---|---|---|
| Authorized payment provider shown at checkout or on the receipt | Payment processing | Process subscription payments for Aibo and provide transaction confirmations | Provider does not store full card details |
4) Subprocessors not currently used (examples)
We do not currently use a third-party support ticketing system (such as Zendesk). If we add a support system in the future, this list will be updated.
Contact: legal@aibotask.com