Sub-processors

1. Introduction

In plain terms: these are the outside companies that help us run SearchChamp: our cloud host, our AI model providers, our SEO and AI-answer data source, and our payment processor. We vet each one, bind them to data-protection terms, and tell you before we add a new one. This page also describes two neighbouring categories for full transparency: services you connect to your own account (section 3) and the consent-based analytics and advertising tools on our public website (section 4).

Atlio Limited (“Atlio Limited”), a company registered in New Zealand, uses the sub-processors listed below to deliver the SearchChamp platform. SearchChamp is a product of Atlio Limited. Atlio Limited conducts regional operations in the United Arab Emirates through its branch, Atlio Information Technology LLC. A sub-processor is a third-party company that processes personal data on Atlio Limited’s behalf in the course of providing services to our customers.

This list is maintained in accordance with our Data Processing Addendum and is updated whenever we add, change, or remove a sub-processor. Customers are notified at least 14 days before we add or replace a sub-processor, by email (if opted in) and by update of this page. The general written authorisation in section 5 of the DPA covers the sub-processors in section 2 of this page.

For the purposes of this list:

• SCCs refers to the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 2: Controller-to-Processor or Module 3: Processor-to-Processor as applicable).
• UK Addendum refers to the International Data Transfer Addendum to the EU SCCs issued by the UK ICO.
• Adequacy decision refers to a European Commission adequacy decision in effect at the time of transfer.

2. Current sub-processors

Last updated: 2026-09-02

Each sub-processor is listed with its purpose, the categories of data it processes, where the processing happens, and the safeguard that covers any international transfer.

Amazon Web Services (AWS)

Anthropic

OpenAI

OpenRouter

Google

DataForSEO

Stripe

AWS Cognito (service detail)

Perplexity (engaged, currently inactive)

xAI (engaged, currently inactive)

3. Connected services you control

In plain terms: some features work by connecting SearchChamp to accounts you already hold with other companies. You choose whether to connect them, we access them only to do what the feature says, and you can disconnect them at any time. These companies serve you under your own agreement with them; they are not our sub-processors, and we list them here so the full picture of data movement is in one place.

• Google integrations: Google Search Console (search query and click data, read-only), Google Analytics 4 (audience and traffic metrics, read-only), and Google Ads (campaign and keyword data; we read this data and do not create or change campaigns). Each is connected via OAuth consent that you grant and can revoke at any time, in SearchChamp or in your Google account settings.
• Email sending for backlink outreach: you can connect a Gmail or Microsoft Outlook mailbox. SearchChamp uses it to send the outreach emails you approve and to read delivery signals such as bounces and replies to those emails. Sending happens from your own mailbox under your own Google or Microsoft account; access tokens are stored encrypted and the connection can be removed at any time.
• Publishing platforms: when you connect a site, SearchChamp publishes and updates content on it at your instruction. Supported platforms include WordPress, Shopify, Wix, Squarespace, Webflow, Ghost, BigCommerce, HubSpot, Duda, HighLevel, Salla, and custom webhooks you configure.
• Notification destinations: you can route SearchChamp notifications to tools you use, such as a Slack workspace or Linear. We send the notification content you configure to the destination you chose; the tokens involved are stored encrypted.

Data sent to or read from a connected service is processed by that provider under its own terms and privacy policy. If we ever engage one of these companies to process personal data on our behalf, rather than at your instruction, it will be added to section 2 first.

4. Analytics and advertising recipients on our website

In plain terms: our public marketing pages use consent-based analytics and advertising tags. They are off by default in every region and stay off until you accept them in our consent banner. The signed-in product contains no advertising or analytics tags at all.

When you grant consent on our public website, the following companies receive the data their tags collect, acting under their own terms: Google (Analytics with Analytics consent; Ads with Marketing consent), Microsoft (Advertising and Clarity, Marketing consent), Meta (Marketing consent), and TikTok (Marketing consent). The cookies involved, their lifetimes, and how to withdraw consent are documented in our Cookie Policy.

If you subscribe to a paid plan while holding an active Marketing grant, we also send a server-side conversion event to Meta and TikTok so the sale is attributed to the ad that led to it. That event contains a SHA-256 hash of the subscribing administrator’s email address and a billing event identifier used for de-duplication; it is sent only where the Marketing grant was given and never otherwise.

These companies are recipients rather than sub-processors: they do not process customer workspace data, and nothing from your signed-in SearchChamp account is shared with them beyond the conversion event described above.

5. Changes to this list

Atlio Limited will update this page whenever a sub-processor is added, changed, or removed. The addition or replacement of a sub-processor will be communicated to customers at least 14 days in advance, consistent with section 5 of our Data Processing Addendum.

Notification methods:

• Email to the primary account holder (for customers who have opted in to sub-processor notifications);
• Update of this page with a revised “last updated” date.

Customers may object to a new sub-processor as described in section 5 of the Data Processing Addendum.

Change history

6. Contact

To opt in to sub-processor change notifications, or for questions about our sub-processors: