Subprocessor List

Effective Date: 1 April 2026 Last Updated: 1 April 2026

GTMSAI Ltd (trading as Pebbles Ai) uses the following third-party subprocessors to assist in providing the Service. This page provides transparency about who processes data on our behalf, what data they process, and where that processing takes place.

This list is maintained in accordance with our obligations under the UK GDPR, EU GDPR, and our Data Processing Agreement.

Current Subprocessors

AI/LLM Service Providers

Our AI features utilise multiple third-party large language model providers via API. The specific provider used may vary by feature and task. These providers process data transiently to generate responses and are contractually prohibited from using customer data for model training. Data is transmitted via encrypted connections.

These providers do not persistently store personal data beyond the duration required for abuse monitoring and safety purposes, as governed by our data processing agreements with them.

Data Protection Safeguards

All subprocessors are bound by data processing agreements that require them to:

• Process personal data only on our documented instructions
• Implement appropriate technical and organisational security measures
• Assist us in fulfilling our obligations to data subjects
• Delete or return personal data upon termination of the agreement
• Submit to audits and inspections as required
• Not use customer data for model training (AI/LLM providers specifically)

Where a subprocessor is located outside the European Economic Area or United Kingdom, we ensure that appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission and/or the UK International Data Transfer Agreement (IDTA) addendum. For further details on international data transfers, see Section 11 of our Privacy Policy.

DPA and Transfer Mechanism Status

Last verified: April 2026

Notification of Changes

GTMSAI Ltd will notify customers of any changes to this subprocessor list in accordance with the following process:

1. Advance notice. We will provide at least 30 days' written notice before engaging a new subprocessor or materially changing the role of an existing subprocessor. Notice will be provided via email to the account owner and/or through an update to this page.

2. Details provided. The notification will include the name of the subprocessor, the purpose of processing, the categories of data processed, and the location of processing.

3. Right to object. If you have a reasonable objection to a new or changed subprocessor based on data protection grounds, you may raise your objection in writing to data@trypebbles.ai within the 30-day notice period. We will work with you in good faith to address your concerns, which may include offering an alternative configuration or workaround. If we cannot reasonably resolve your objection, you may terminate the affected services by providing written notice, and we will refund any prepaid fees for the unused portion of the subscription term following the effective date of termination.

4. Deemed acceptance. If you do not object within the 30-day notice period, you are deemed to have accepted the new or changed subprocessor.

Staying Informed

To receive notifications about subprocessor changes, ensure that the email address associated with your account is current. You can update your email address in your account settings at app.trypebbles.ai.

Contact

If you have questions about our subprocessors or data processing practices, please contact:

Data Protection Officer: data@trypebbles.ai

Postal address: GTMSAI Ltd 82 Wandsworth Bridge Road London, SW6 2TF United Kingdom