SUBPROCESSOR LIST

2.1 Polar Software, Inc. — Merchant of Record

Polar operates as the Merchant of Record for all Hookd Group transactions, meaning Polar (not Hookd Group) is the entity that contracts directly with the Client for the payment transaction and handles tax, refunds, and chargeback flows. Card data is tokenised by Polar and not stored by Hookd Group.

2.2 AI Provider Stack — Tier-Based Routing

Per the internal AI Model Routing Specification Hookd Group uses a least-cost-with-quality-floor routing logic across multiple AI providers. The current stack comprises:

• Premium tier — customer-facing or buyer-facing copy: Anthropic Claude Sonnet 4.5. Used for Cast (content from topic), post variant generation per platform, website-scan onboarding, and the first-hook onboarding step.
• Mid tier — high-volume personalisation: Anthropic Claude Haiku 4.5 with auto-upgrade to Sonnet 4.5 where the workspace-specific edit-rate signal indicates the cheaper model is insufficient. Used for personalised outreach openers.
• Cost tier — structured numeric output: OpenAI GPT-4.1-nano. Used for lead scoring (intent + ICP fit) where the output shape is short structured JSON and reasoning-ceiling is not the binding constraint.
• Structured-extraction tier — Google Gemini 2.5 Flash. Used for sales-material extraction (PDF / deck → structured value-prop JSON), schema-validated with mock-fallback on validation failure.
• Broad-knowledge low-volume tier — Google Gemini 2.5 Pro. Used for Telegram channel discovery; results cached for 14 days, so per-call volume is low.

The routing logic includes a quality-floor mechanism: each generation is validated against format, length and structure checks plus a sampled comparison against a higher-tier model. On failure the call retries once on the same model; if it still fails the call auto-upgrades to the next tier within the same provider family (e.g. Anthropic Haiku 4.5 → Sonnet 4.5 → Opus 4 family for Anthropic-routed jobs). Auto-upgrade is bounded to same-provider tier transitions and does not move Client data between providers.

Provider rotation and tier transitions are governed by the routing logic and are not Controller-controlled. Where the Controller has a documented data-protection objection to a specific provider, Hookd Group will accommodate within reasonable engineering constraints, including via the Bring-Your-Own-Key (BYOK) arrangement described in Section 3 below.

2.3 OpenAI

OpenAI OpCo, LLC (Delaware, USA), processing AI-generation inputs for lead-scoring jobs. API calls do not retain Client Content beyond OpenAI's 30-day abuse-monitoring window; OpenAI does not train its models on API data (paid API default). Transfer mechanism: SCCs Module 3 + EU-US Data Privacy Framework. OpenAI is SOC 2 Type II audited.

2.4 Google (Gemini API)

Google LLC (California, USA), processing AI-generation inputs for sales-material extraction and Telegram channel discovery. Paid Gemini API tier is configured: 0-day API retention, no logging of inputs for training. Transfer mechanism: SCCs Module 3 + EU-US Data Privacy Framework. Google is SOC 2 Type II audited. Regional pinning is available and may be enabled for specific Controllers on request.

2.5 Hosting and Backup

As of the version date of this List, the hosting and backup providers are: Hetzner Online GmbH (Frankfurt, Germany) for application hosting, web server, database, and file storage (see Section 1 table). Hetzner is a Germany-incorporated entity with primary data centres in Germany; no cross-border transfer outside the EEA is involved for the hosting relationship. The provider-selection preferences applied were:

• EU-region (Germany, France, or Ireland) for primary storage of Client Content — minimises cross-border transfer issues
• Provider with ISO 27001 or equivalent certification
• Provider offering encryption at rest with key-management controls
• Backup provider with cross-region replication and air-gapped option for incident-recovery scenarios