Sub-processors
Every external provider that processes data as part of the service, with its place of establishment and transfer basis.
Last updated: 17 August 2026
This list forms part of the Data Processing Agreement. In case of discrepancies between the language versions, the German version prevails.
How we notify changes
We give at least 30 days' notice before adding or changing a sub-processor, by in-app notice or email.
As controller you may object on reasoned grounds within 14 days. If we cannot reasonably resolve the objection, you may terminate at no cost and request an export of your data.
The list
| Provider | Purpose | Established in | Transfer basis |
|---|---|---|---|
| Supabase Pte. Ltd | User authentication, database, file storage, realtime notifications, and the transactional emails for account confirmation and password reset | 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513 | EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914). No EU-US Data Privacy Framework certification. |
| Vercel Inc. | Hosting of the web application and cookieless anonymous visit statistics | 440 N Barranca Ave #4133, Covina, CA 91723, USA | EU-US Data Privacy Framework certification (including the UK and Swiss extensions) alongside EU Standard Contractual Clauses. |
| Stripe Payments Europe, Ltd. (EU main establishment: Stripe Technology Company, Ltd. (Ireland); US entity: Stripe, LLC) | Processing the one-time Premium payment, fraud prevention, regulatory obligations. For payment data Stripe acts as an independent controller, not as our processor. | The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland | EU Standard Contractual Clauses and EU-US Data Privacy Framework certification for the US entity. |
| Plus Five Five, Inc. (Resend) | Sending transactional email: the order confirmation carrying the withdrawal instruction. The message content and your address pass through their servers. | 2261 Market Street #5039, San Francisco, CA 94114, USA | EU-US Data Privacy Framework certification together with EU Standard Contractual Clauses. Processing takes place primarily in the United States. |
| Google Ireland Limited (Google sign-in) | Signing in with a Google account, where a user chooses it. Google is an independent controller, not our processor. | Gordon House, Barrow Street, Dublin 4, Ireland | EU-US Data Privacy Framework certification for Google LLC. |
| Google Ireland Limited (YouTube) | Tutorial videos in the dashboard, in privacy-enhanced mode. Loaded only after a user opens a video themselves. | Gordon House, Barrow Street, Dublin 4, Ireland | EU-US Data Privacy Framework certification for Google LLC. |
The Google services are listed for completeness, although in those cases Google is not our processor but an independent controller.
Provider documentation
Our providers' own policies and data processing agreements:
- Supabase: https://supabase.com/legal/dpa and their own sub-processor list at https://supabase.com/legal/customer-resources/subprocessor-list
- Vercel: https://vercel.com/legal/dpa and their own sub-processor list at https://security.vercel.com
- Stripe: https://stripe.com/legal/dpa and their own service provider list at https://stripe.com/legal/service-providers
- Resend: https://resend.com/legal/dpa and their own sub-processor list at https://resend.com/legal/subprocessors
- Google: https://policies.google.com/privacy
What we do not use
We use no advertising network, no cross-site tracking tool, no cookie-based measurement tool, no helpdesk system, no marketing email tool and no artificial intelligence service.
We do not sell data and do not share it for advertising.
A question about sub-processors?
If your own records need more detail, get in touch. The processing agreement is at /avv.
Send a question