Sub-processors
This page lists the outside services that process personal data for QtecX, what each one does, what data it receives and where. It is part of the Privacy Policy.
In short
- We keep most data on our own servers in the European Union. In the desktop app, your files stay on your computer except what the agent sends to do your task.
- Outside services get only what their job needs, under contracts that protect your data.
- AI model providers process your prompts and files to produce answers and media; where we can choose, they may not train on them.
- Paddle handles payments as an independent controller.
- We tell you here, at least 30 days ahead where we can, before we add a new sub-processor.
What changed in version 2.0: code search for the desktop app now runs on our own servers, so the outside code-search provider is gone from this list; our automated quality and safety checks run on our own servers; your own AI provider and the apps you connect are listed as your own services. Version 1.4 and version 1.3 stay available.
Run by us
These parts of QtecX run on servers we control, so your data does not go to another company for them: the main databases, file and object storage, the memory and its embeddings, the code-search embeddings for the desktop app, the automated quality, safety and security checks of sessions and the log of human looks at content, the project copies of your work and the encrypted code backup, conversation search, re-ranking, document reading and text recognition (OCR), speech to text and text to speech, the web-search server, the desktop app's device pairing and update feed, analytics, and the logs.
Infrastructure
| Service | What it does | Data it receives | Location | Safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH | Hosts our servers, storage and backups | All data we store | Germany and Finland (EU) | EU provider, data processing agreement |
| Resend | Sends account emails (sign-up, review, security, receipts of requests) | Your email address, name and the email's text | United States | Standard Contractual Clauses |
| Hostinger | Our domain name and its DNS | No account data (the addresses of our servers only) | Lithuania (EU) | EU provider |
| Mail forwarding service (ImprovMX) and the operator's mailbox provider | Receives mail you send to our addresses | What you write to us, your email address | United States | Standard Contractual Clauses |
| Bot check (Cloudflare Turnstile), when enabled | Checks that a real person is signing up | IP address, browser signals | United States and global network | Data Privacy Framework, Standard Contractual Clauses |
| Operator alert push service, when configured | Sends urgent service alerts to the operator's phone | Alert text; at most an internal account number, never your content | European Union or United States | Data processing terms |
AI and media providers
| Category | What it does | Data it receives | Location | Safeguard |
|---|---|---|---|---|
| AI model providers, reached directly | Produce the agent's answers, code and reasoning | Your prompts, the conversation and project context the agent sends, files and images you add | United States, Singapore, China | Standard Contractual Clauses; no training on your content where we can choose; short retention for abuse checks |
| AI routing provider | Routes a request to an AI model provider and returns the answer | The same as above, in transit | United States (providers worldwide) | Standard Contractual Clauses; providers that train on prompts are excluded where the routing lets us choose |
| Media generation providers | Generate images, video, audio and 3D models you ask for | The prompt, and any picture or file you give as a starting point | United States, China | Standard Contractual Clauses; no training where we can choose |
The names of the AI model, routing and media providers are given on request: write to hello@qtecx.si with the subject "Sub-processors".
Search and public data
| Service | What it does | Data it receives | Location | Safeguard |
|---|---|---|---|---|
| Web search engines (Google and others, through our own search server) | Answer the web searches the agent makes | The search words only, never your account | United States and others | Queries are sent from our server, not your browser |
| Open-Meteo | Weather answers | The place or coordinates the agent asks about | Switzerland and EU | No account data |
| Websites the agent visits for you, in the desktop app | Pages the agent reads or tests in its browser inside the app | What a normal visit from your computer sends: your device's IP address and the cookies of that browser | Worldwide | The visit comes from your device, like your own browsing; the app's browser is kept apart from your everyday browser |
| Websites the agent visits for you, on a cloud computer | Pages the agent reads or tests | What a normal visit sends (our server's address) | Worldwide | Visits come from our servers, not your device |
| Download sources for tools the desktop app installs (for example Git for Windows, language tools for your code) | Deliver the program when you accept it or when a tool is first needed | What any download sends: your device's IP address | Worldwide | Only official sources; nothing about your account |
Independent controllers
These companies process data for their own purposes under their own privacy notices, not as our processors:
| Company | Role | Location |
|---|---|---|
| Paddle.com (Paddle.com Market Ltd and its affiliates) | Our reseller and Merchant of Record: checkout, card data, tax, invoices, refunds, fraud checks | United Kingdom, with processing in the EU and US |
| Sign-in providers you choose (Google, GitHub, Discord, Apple) | Confirm who you are when you sign in with them | United States |
| Microsoft (Microsoft Store), if you install the desktop app from it | Delivers and updates the app | As it states |
| Your own AI provider, if you connect your own key (QtecX 1 Key) | Runs the model calls made with your key, bills you and keeps or uses your requests under your agreement with it | As it states |
| Apps and tool servers you connect yourself (for example through the Connectors in the composer or an MCP server you add) | Act on your behalf under your own account with them | As they state |
Changes to this list
We update this page when we add or replace a sub-processor, and show the date at the top. Where we can, we announce a new sub-processor at least 30 days before it starts receiving personal data. If you object to a new sub-processor, write to hello@qtecx.si; if we cannot address the objection, you can close your account, and a paid plan is refunded for the unused part.
Related policies: Privacy Policy · Data Requests