Sub-processors
Last updated: 11 August 2026
This page lists the service providers ("sub-processors") that process personal data on Ayla's behalf, what each one does, and where it processes data. It is the list our Privacy Policy points to, and we keep it current: when a provider is added or replaced, this page changes before the provider starts processing your data.
Ayla is operated by Ayfinity Labs S.à r.l.-S (Luxembourg), the data controller. Every provider below processes data only on our instructions, under a contract that requires it to protect your data and to use it for nothing else. Our AI providers are additionally barred from using your data to train their models.
We have built Ayla to process personal data inside the European Union. Where a provider's parent company is based outside the EU, we rely on the European Commission's Standard Contractual Clauses (SCCs) so your data keeps EU-level protection. Section 9 of the Privacy Policy explains this in more detail.
AI processing
- Google Cloud (Vertex AI). The AI that reads your conversation and helps rank matches. Processes in the EU.
- Amazon Web Services (Bedrock, running Anthropic Claude). The fallback AI for the same tasks when the primary is unavailable, and one of the two AI routes we use internally to review conversations so we can improve the service. Processes in the EU (Frankfurt).
- Requesty (EU AI router, running Anthropic Claude). The second of those two internal review routes, which lets us use newer Claude models than our other provider can reach. It does not take part in the conversations themselves. Stores and processes in the EU (Frankfurt), routes only to EU data centres, and is set so that the contents of our requests are not logged.
- Mistral (La Plateforme). An alternative AI for the same tasks. Processes in the EU (Paris).
- Microsoft Azure (OpenAI Service). Converts your WhatsApp voice messages to text. Processes in the EU (Sweden).
Messaging
- Meta (WhatsApp Business Cloud API). The WhatsApp channel you talk to Ayla through. Meta necessarily processes your phone number and message content to deliver messages. Messages travel through Meta's own global systems, protected by Meta's legal safeguards, including Standard Contractual Clauses.
Identity verification
- Didit. The identity-verification partner for the forming-flatshare track (and for the women-only track, if identity checks are switched on there). Didit handles the ID document and selfie on the EU side and returns only the result to Ayla. We never receive or store the images, and Didit only receives data when you go through a verification. Didit holds the ID document and selfie for one month, then deletes them, and it does not use your data to train its models.
Hosting, database, and operations
- Cloudflare. Application hosting, conversation storage, uploaded photos, and documents. Processes in the EU.
- Neon. The database that holds profile and matching data, with the most sensitive fields encrypted. Processes in the EU.
- Vercel. Hosting for this website and our web portals, and cookieless website analytics (aggregate visit and click counts, no cookies, no individual tracking). The website is hosted in the EU (Frankfurt). The analytics are anonymous and cookieless by design: visits are counted from a short-lived hash, no cookie is set, nothing is stored on your device, no IP address is kept, and no visitor is followed across websites. We see counts and trends, never an individual visitor.
- LangFuse. Observability for our AI calls, so we can check quality and fix problems. EU-hosted.
- Sentry. Error monitoring. We remove personal details before they reach it wherever we can. Processes in the EU (Frankfurt).
Changes to this list
This list will change as Ayla grows, for example when we add a payment processor or a backup provider. We update this page before a new provider starts processing your data. If you have a question about any provider here, or you object to a change, contact us at privacy@ayla.lu or on WhatsApp at +352 404 002.