Please see the below list of sub-processors that Hotjar has engaged with, the country they operate from, and the service(s) they provide.
Sub-Processor | Country | Service | Sub-Processor Measures |
Amazon Web Services | Ireland | Cloud Service Provider | Shared Responsibility Model |
Microsoft, Azure OpenAI Service | USA | Large Language Model (LLM) provider (optional only if you choose to use AI-powered features) | Data Safety, Privacy & Security |
Zendesk, Inc. | USA | Customer service platform | Trust Center |
Ada Support Inc. | Canada | Customer service ticket management tool | Privacy Legal Resources |
Affiliate Sub-Processor | Country | Service | Sub-Processor Measures |
Hotjar Germany GmbH | Germany | Hotjar affiliate | Data Safety, Privacy & Security |
Hotjar Web Services Spain, S.L. | Spain | Operational support | Data Safety, Privacy & Security |
Hotjar UK Limited | UK | Operational support | Data Safety, Privacy & Security |
Hotjar Netherlands BV | Netherlands | Operational support | Data Safety, Privacy & Security |
Hotjar Web Portugal, Unipessoal LDA | Portugal | Operational support | Data Safety, Privacy & Security |
Content Square SAS | France | Consulting, Support, Maintenance, Implementation, and Development | Data Safety, Privacy & Security |
Heap Inc. | USA | Consulting, Support, Maintenance, Implementation, and Development | Data Safety, Privacy & Security |
User Interviews & User Tests capabilities specific Sub-Processor | Country | Service | Sub-Processor Measures |
Twilio Inc. | Ireland | Video hosting provider for Interviews capability | Security and Compliance commitments |
Daily.co |
Ireland* USA** |
Video hosting provider for User Tests capability | Security and Compliance commitments |
Postmark | USA | Email delivery service | Security and Compliance commitments |
* Recordings are stored in AWS Ireland (eu-west-1). Calls are hosted according to the tester’s geographic location, see more information here.
** The tester’s name and duration of their test are stored in the AWS USA (us-west-2).
Following an internal assessment, we identified that some of the vendors listed above were not included in our previous list; Hotjar has always used these vendors for the identified purpose, they are not new sub-processors.
Hotjar is committed to ensuring that all of its sub-processors have the appropriate legal and security safeguards in place to ensure that your data will remain protected to the highest standards. This includes signing a Data Processing Agreement (together with Standard Contractual Clauses, where applicable) with all of our sub-processors and ensuring they all have supplementary measures in place, where applicable.
Should Hotjar need to designate further sub-processors or make any change to the existing sub-processors, Hotjar will inform its customers and give customers ten (10) business days from giving notice to reasonably object to these changes.