Dear Customer,

At Sendbird, trust and security are foundational to everything we do. We continuously enhance our platform to maintain a secure and reliable environment, so you can confidently deliver the same level of trust to your own users.

As part of our ongoing improvements and in accordance with our data protection obligations, we are notifying you of new service providers that will be added as Sendbird sub-processors effective October 21, 2026 (5 days after the date of this notice).

These service providers may process your organization's "personal data" (as defined under the EU General Data Protection Regulation (GDPR)) in connection with Sendbird's products and services. This email serves as formal notice of these additions.

All information handled by these sub-processors will remain protected as confidential information under the terms of Sendbird's Data Processing Agreement (DPA) and sub-processing obligations.

Sub-Processor Information

Please find the list of newly added sub-processors below:

• Name: Upstage Co., Ltd.
• Data Location: Republic of Korea
• Description of Processing: LLM inference provider used to generate responses for Sendbird’s AI Agent. This applies only to customers in Korea who use the AI Agent. Their data is processed only in Korea, and Upstage is configured for zero data retention, so prompts and responses are not stored by Upstage or used to train its models.
• Data Processed: End-user conversation content submitted to the AI Agent (may include personal data contained in the messages).

• Name: Firecrawl (SideGuide Technologies)
• Data Location: United States
• Description of Processing: Web crawling API used to retrieve public web pages for the knowledge base of Sendbird’s AI Agent. This applies only to customers who use the AI Agent and add their public website URLs (for example, help center articles) as knowledge sources. Only publicly accessible pages are crawled, and no end-user conversation data is sent to Firecrawl.
• Data Processed: Public website URLs and publicly available web page content provided by customers (may incidentally include personal data published on those pages).

This list has been reviewed and approved through Sendbird's Vendor Risk Assessment and third-party risk management process.

If you have any questions or wish to raise a concern, please contact us at privacy@sendbird.com within 5 days of receiving this notice.

Thank you for trusting Sendbird.

Best regards,
Sendbird