Processor Register

1. Purpose

This Processor Register identifies the third-party processors and sub-processors used by Q Intelligence, operated by Scott Harvey-Whittle trading as SHW Digital Services, in the provision of our services.

This register supports transparency under applicable data protection legislation, including the UK GDPR and, where applicable, the EU GDPR.

2. Current Sub-processors

WebLLM performs inference on the user's device and is not used by Q as a processor of prompts on Q's behalf. A user's browser contacts model-distribution infrastructure to download the WebLLM runtime and model assets; those services may process ordinary network metadata under their own policies.

For Microsoft 365, the applicable Microsoft Products and Services Data Protection Addendum and tenant agreement govern the provider processing. The precise contracting entity, tenant geography, retention configuration and transfer terms depend on the operator's Microsoft 365 subscription and configuration. This register does not assert a particular data centre or exclusive in-country processing. Review the Microsoft DPA and the tenant's own service terms before relying on the integration.

For hosted AI generation, Q uses Groq when GROQ_API_KEY is configured and otherwise uses OpenAI when OPENAI_API_KEY is configured. If an OpenAI key is configured, Q may separately send the PII-masked user message to OpenAI to create an embedding for optional vetted-knowledge retrieval, even when Groq generates the response. Groq states that inference requests are not retained by default but may be temporarily logged for reliability troubleshooting or abuse investigations for up to 30 days; Groq offers an organisation-level Zero Data Retention control, which is not enabled by Q unless separately configured. Groq states that retained customer data is stored in US Google Cloud Platform buckets. Review the Groq terms and transfer safeguards before use. OpenAI's API processing terms and retention disclosures apply when OpenAI is selected for generation or embeddings. OpenAI states that API inputs and outputs are not used to train its models by default unless the API customer explicitly opts in; standard API abuse-monitoring logs may retain customer content and associated metadata for up to 30 days unless a different approved retention control applies or law requires longer retention.

Current governing and transparency documents:

• Groq Data Processing Addendum: https://console.groq.com/docs/legal/customer-data-processing-addendum

• Groq data retention and location: https://console.groq.com/docs/your-data

• Groq Services Agreement: https://console.groq.com/docs/legal/services-agreement

• Groq sub-processors and security information: https://trust.groq.com/

• OpenAI Services Agreement: https://openai.com/en-GB/policies/services-agreement/

• OpenAI Service Terms: https://openai.com/policies/service-terms/

• OpenAI Data Processing Addendum (effective 1 January 2026): https://openai.com/policies/data-processing-addendum/

• OpenAI Sub-processor List: https://openai.com/policies/sub-processor-list/

• OpenAI API data controls: https://platform.openai.com/docs/models/default-usage-policies-by-endpoint

2.1 Brevo Email Communications

Optional incoming Brevo webhooks store provider payloads, supplied email addresses, event type and receipt/review metadata in Supabase for Admin review. Known credential fields are redacted. This is separate from Microsoft 365 message bodies and attachments, which stay in Exchange Online; matched office email metadata is logged in private Supabase CRM records. Verify the applicable Microsoft contracting entity, tenant geography, retention settings and processing terms against the operator's account. This entry does not assert exclusive processing in a particular country.

Q acts as controller for its marketing and community mailing lists. Brevo processes mailing data on Q's instructions under the applicable Brevo data-processing agreement. Its exact contracting entity and applicable terms depend on Q's Brevo account agreement; the brand name alone does not determine the contracting entity.

Brevo's published storage information describes database hosting in the European Union. This is not a guarantee that all support access, sub-processing or onward processing occurs solely in the EU. The applicable agreement, selected services, sub-processor arrangements and legally required international-transfer safeguards govern those activities.

Q limits campaign data to the purposes described in Privacy Policy section 16. Private journal entries, chat content, mood logs and programme reflections are not campaign-list data. Optional marketing consent, any required tracking consent, and unsubscribe/suppression records must be managed separately from account authentication and billing communications.

Provider references:

• Brevo Privacy Policy: https://www.brevo.com/legal/privacypolicy/
• Brevo Terms of Service, including its DPA: https://www.brevo.com/legal/termsofuse/
• Brevo DPA location guidance: https://help.brevo.com/hc/en-us/articles/15403782599570-Where-can-I-find-the-Data-Processing-Agreement-DPA
• Brevo data storage information: https://help.brevo.com/hc/en-us/articles/360001005510-Data-storage-location
• Brevo email tracking and consent controls: https://help.brevo.com/hc/en-us/articles/37114679474706-About-email-tracking-pixels-and-the-CNIL-recommendation-in-Brevo

2.2 Brevo Conversations Support Chat

The Brevo Conversations widget has been removed from Q. Historical support records may remain with Brevo under the applicable provider agreement. Removing the widget does not delete those earlier records. No new website chat is initiated through this integration.

Requests concerning Brevo chat records are handled through [email protected]. Q account export and deletion do not automatically export or erase these separate records. Support retention, international transfers and provider access remain subject to the applicable agreement and configured service; no fixed chat-retention period or exclusively UK hosting is asserted here.

Brevo visitor-data guidance: https://help.brevo.com/hc/en-us/articles/4608779872018-Understand-the-Visitors-online-page

3. Infrastructure Providers

Q Intelligence may also rely upon reputable infrastructure and service providers for functions including:

• DNS and networking;
• content delivery;
• email delivery;
• security monitoring;
• application hosting;
• backup services;
• logging and diagnostics.

Only providers necessary for the secure and reliable operation of the Service are engaged.

4. Selection Criteria

Before engaging a processor, we consider factors including:

• security practices;
• reliability;
• privacy compliance;
• contractual safeguards;
• operational suitability;
• reputation;
• legal obligations.

5. Processor Obligations

Where applicable, processors are expected to:

• process data only on authorised instructions;
• implement appropriate security measures;
• maintain confidentiality;
• assist with applicable legal obligations;
• notify relevant security incidents where contractually required.

6. International Data Transfers

Some processors may process data outside the United Kingdom.

Where required by applicable law, appropriate transfer safeguards will be implemented before international transfers occur.

Such safeguards may include:

• adequacy regulations;
• approved contractual clauses;
• recognised international transfer mechanisms;
• other lawful transfer mechanisms.

7. Changes to Processors

We may:

• appoint additional processors;
• replace existing providers;
• discontinue processors;
• update processing activities.

This Processor Register will be updated periodically to reflect material changes.

8. Customer Questions

Customers with questions regarding our processors or processing activities may contact us using the details below.

Where appropriate, additional information may be provided subject to confidentiality, security, and legal obligations.

9. Contact

Scott Harvey-Whittle
Trading as SHW Digital Services

Website: https://q-ai.online

Privacy: [email protected]

Legal: [email protected]

10. Related Documents

This Register should be read together with:

• Privacy Policy
• Data Processing Addendum
• Security Policy
• Terms of Service

11. Version History

© Scott Harvey-Whittle trading as SHW Digital Services. All rights reserved.

News and Help Video processing

Supabase also stores public news and update relationships, Help Video titles and steps, video links, administrator publishing identifiers and uploaded video files in a private Storage bucket. Published uploads use time-limited playback links. Unpublished and archived files are retained until separately removed under the operator's retention process.

Administrators may link to an external video host. Q opens these destinations on selection and does not automatically embed them. These hosts apply their own privacy settings; listing a link does not establish that host as a contracted Q processor.