1. How to read this list
Not every listed provider is a subprocessor for every processing activity. A payment provider may act as an independent controller when processing a payment. An integration provider is involved only after the customer expressly connects an account. The purpose, contractual role and actual flow of data determine the provider's status.
2. Current and conditional services
| Provider | Purpose | Location | Activation and role |
|---|---|---|---|
| Websupport, s.r.o. | Delivery of operational emails and support messages. | Slovak Republic and EEA according to the selected service. | Active for email communication. Processor to the extent that it processes data on behalf of CREALAB. |
| Stripe Payments Europe, Limited and Stripe affiliates | Processing card payments, subscriptions and billing events, and preventing fraud. | EEA and possible third countries under Stripe's terms. | Only if the customer selects Stripe. Stripe may act as an independent controller for part of the payment processing. |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. and PayPal affiliates | Processing payments and subscriptions through PayPal. | Luxembourg, EEA and possible third countries under PayPal's terms. | Only if the customer selects PayPal. PayPal may act as an independent controller. |
| Google Ireland Limited and Google affiliates | OAuth connection and optional access to Google Analytics Data API data in the customer's account. | EEA and possible third countries according to Google's settings and terms. | Only after the customer expressly activates the integration. This is not a GA4 tracker on the public Reevals website. |
| OpenAI Ireland Limited, OpenAI, L.L.C. or another configured model provider | Optional AI explanations, suggestions or diagnostics to the extent of the function and the customer's instruction. | EEA or a third country according to the selected provider and contractual mechanism. | Only if an external model is configured for production and the customer uses the relevant function. A local model does not send data to an external provider. |
Before production deployment on a specific hosting platform, CREALAB must add the name of the production infrastructure operator, the country of processing and the transfer mechanism used to this list. Until external hosting has been selected, it cannot be identified accurately.
3. Notice of changes
We will notify customers of a planned addition or replacement of a subprocessor in accordance with the DPA at least 15 days in advance. A reasoned objection relating to personal-data protection may be sent to support@reevals.com.
Version 1.0 of this list is effective from 25 August 2026. The last-updated date is the same as the effective date shown on this page.