Data processing.
Website providers and data-processing agreements for client work.
Updated 11 September 2026. This page provides information; it is not a signed data-processing agreement and does not amend an existing client contract.
Website processing
Sengi AI AB determines the purposes of its website analytics and business enquiries. The current website uses the following services. This list describes website processing, not a blanket list of subprocessors authorised for every client project.
OpenAI: ChatGPT Sites
Provides the website hosting platform and, where applicable, platform access controls. Technical requests and security information may be processed to deliver and protect the site. The applicable agreement depends on the OpenAI account and service used. Links here do not establish that a particular business DPA applies to a personal account.
Privacy policy · Published business DPA · Published business subprocessor list
Cloudflare: delivery infrastructure
Provides underlying delivery and hosting infrastructure for the ChatGPT Sites deployment. Cloudflare operates an international network. Its role here is through the hosting arrangement, not a claim that Sengi has a separate direct hosting agreement with Cloudflare. OVH is not used to host this version of the website.
Privacy policy · Published customer DPA
PostHog: EU website analytics
PostHog Inc. provides EU Cloud analytics, with analytics storage in Frankfurt. Our integration sends limited pseudonymous usage events. Browser persistence, person profiles and session recording are disabled. Client IP data is discarded from stored events and IP-based geolocation is disabled. The service still receives network requests.
DPA and agreement process · Subprocessors · Storage information
Email and meeting bookings
Google Workspace handles email and Morgen handles bookings made through our external booking link. These services remain separate from website hosting and analytics.
Location and transfers
EU analytics storage does not establish EU-only processing across the provider chain. Hosting, support and security processing can involve countries outside the EEA. The applicable provider agreements describe locations, subprocessors and transfer safeguards. We do not represent the public links above as evidence that a particular agreement has been executed.
Client data-processing agreements
Where Sengi processes personal data on a client’s behalf, the processing instructions and applicable data-processing agreement belong to that engagement. Contact johannes@sengi.se to request or review the agreement and the project’s provider list before sharing client personal data.
The engagement documentation should identify the scope and duration, purposes, data and people concerned, authorised providers and processing locations, security measures, assistance with rights and incidents, and return or deletion arrangements. Adding analytics to Sengi’s marketing website does not itself authorise these providers to process a client’s operational data.
For website visitors, see the privacy notice and cookie notice.