Please see the below list of sub-processors that Hotjar has engaged with, the country they operate from, and the service(s) they provide.
| Sub-Processor | Country | Service | Sub-Processor Measures |
| Amazon Web Services | Ireland | Cloud Service Provider | Shared Responsibility Model |
| Microsoft, Azure OpenAI Service | USA | Large Language Model (LLM) provider (optional only if you choose to use AI-powered features) | Data Safety, Privacy & Security |
| Zendesk, Inc. | USA | Customer service platform | Trust Center |
| Ada Support Inc. | Canada | Customer service ticket management tool | Privacy Legal Resources |
| Affiliate Sub-Processor | Country | Service | Sub-Processor Measures |
| Hotjar Germany GmbH | Germany | Hotjar affiliate | Data Safety, Privacy & Security |
| Hotjar Web Services Spain, S.L. | Spain | Operational support | Data Safety, Privacy & Security |
| Hotjar UK Limited | UK | Operational support | Data Safety, Privacy & Security |
| Hotjar Netherlands BV | Netherlands | Operational support | Data Safety, Privacy & Security |
| Hotjar Web Portugal, Unipessoal LDA | Portugal | Operational support | Data Safety, Privacy & Security |
| Content Square SAS | France | Consulting, Support, Maintenance, Implementation, and Development | Data Safety, Privacy & Security |
| Heap Inc. | USA | Consulting, Support, Maintenance, Implementation, and Development | Data Safety, Privacy & Security |
| User Interviews & User Tests capabilities specific Sub-Processor | Country | Service | Sub-Processor Measures |
| Twilio Inc. | Ireland | Video hosting provider for Interviews capability | Security and Compliance commitments |
| Daily.co |
Ireland* USA** |
Video hosting provider for User Tests capability | Security and Compliance commitments |
| Postmark | USA | Email delivery service | Security and Compliance commitments |
* Recordings are stored in AWS Ireland (eu-west-1). Calls are hosted according to the tester’s geographic location, see more information here.
** The tester’s name and duration of their test are stored in the AWS USA (us-west-2).
Following an internal assessment, we identified that some of the vendors listed above were not included in our previous list; Hotjar has always used these vendors for the identified purpose, they are not new sub-processors.
Hotjar is committed to ensuring that all of its sub-processors have the appropriate legal and security safeguards in place to ensure that your data will remain protected to the highest standards. This includes signing a Data Processing Agreement (together with Standard Contractual Clauses, where applicable) with all of our sub-processors and ensuring they all have supplementary measures in place, where applicable.
Should Hotjar need to designate further sub-processors or make any change to the existing sub-processors, Hotjar will inform its customers and give customers ten (10) business days from giving notice to reasonably object to these changes.