All of our sub processors are beholden to GDPR regulations. As stated in our privacy policy, all user data is stored in private, encrypted GDPR compliant servers within the EU.

Sub-processor 1: Hetzner

Company’s full name: Hetzner Online GmbH

Company reg. number (or equivalent): HRB 6089 (District Court Ansbach)

Company address (incl. country): Industriestr. 25, 91710 Gunzenhausen, Germany

Other addresses which process personal data: Data centers in Germany and Finland.

Contact person at sub-processor: [email protected]

Does the Data Processor have an agreement with the sub-processor which fulfils the requirements of the Data Processing Agreement?: Yes

Data processing which the sub-processor participates in: Data storage services. User data is hosted on Hetzner and Scaleway, in EU data centers.

Categories of personal data processed by the sub-processor: User data, application data, metadata, IP addresses.

Sub-processor 2: Hostup

Company’s full name: Hostup AB

Company reg. number (or equivalent): Org.nr: 559290-1325

Company address (incl. country): Mässvägen 4, 125 30 Älvsjö, SWEDEN

Contact person at sub-processor: [email protected]

Does the Data Processor have an agreement with the sub-processor which fulfils the requirements of the Data Processing Agreement?: Yes

Data processing which the sub-processor participates in: Data storage services.

Categories of personal data processed by the sub-processor: User data, application data, metadata, and IP addresses.

 

Sub-processor for AI
Enterprise deployment allows you to choose between two distinct AI infrastructure setups depending on your data localization and compliance needs:

Option A (Standard): OpenAI Ireland Ltd. All persistent data remains strictly on our EU servers. OpenAI does not permanently store any customer content or use it for model training. However, temporary, transient transferring may occur to the USA for processing under signed GDPR-compliant Data Processing Agreements and Standard Contractual Clauses.

Option B (Enterprise): Azure OpenAI. All data handling is kept entirely within the European Union. Both the transient processing and persistent storage remain restricted to the EU (specifically within Azure’s Sweden region), ensuring zero data transfer outside the EEA.

3a: OpenAI Ireland Ltd

Company’s full name: OpenAI Ireland Ltd

Company reg. number (or equivalent): 737350

Company address (incl. country): The Liffey Trust Centre 117-126, Sheriff Street, Upper, Dublin 1, Ireland, D01 YC43.

Other addresses which process personal data: None

Contact person at sub-processor: [email protected]

Does the Data Processor have an agreement with the sub-processor which fulfils the requirements of the Data Processing Agreement?: Yes

Data processing which the sub-processor participates in: hosting and usage for natural language processing and machine learning services. Only used for processing. .

Categories of personal data processed by the sub-processor: User input data for processing text for genAI functionalities.

Sub-processor 3b: Azure OpenAI

Company’s full name: Microsoft Ireland Operations Limited

Company reg. number (or equivalent): 256796

Company address (incl. country): 70 Sir John Rogerson’s Quay, Dublin 2, Ireland

Other addresses which process personal data: Data center located entirely in EU/Sweden.

Contact person at sub-processor: Microsoft Privacy Team

Does the Data Processor have an agreement with the sub-processor which fulfils the requirements of the Data Processing Agreement?: Yes.

Data processing which the sub-processor participates in: Hosting and usage for natural language processing and machine learning services. Both processing and storage are strictly localized to the EU.

Categories of personal data processed by the sub-processor: User input data for processing text for genAI functionalities.

Sub-processor 4: AssemblyAI

Company’s full name: AssemblyAI, Inc.

Company reg. number (or equivalent): 6280120

Company address (incl. country): 2261 Market Street. Suite 4577. San Francisco, CA 94114. United States.

Other addresses which process personal data: None

Contact person at sub-processor: [email protected]

Does the Data Processor have an agreement with the sub-processor which fulfils the requirements of the Data Processing Agreement?: Yes

Data processing which the sub-processor participates in:

Categories of personal data processed by the sub-processor: Audio files, transcription data.

Sub-processor 5: Mixpanel

Company’s full name: Mixpanel, Inc

Company reg. number (or equivalent): 4689044

Company address (incl. country): One Front Street, 28th Floor, San Francisco, California, 94111, USA

Other addresses which process personal data: N/A

Contact person at sub-processor: [email protected]

Does the Data Processor have an agreement with the sub-processor which fulfils the requirements of the Data Processing Agreement?: Yes

Data processing which the sub-processor participates in: Data analytics, IT troubleshooting. Hosted on EU data centers.

Categories of personal data processed by the sub-processor: User analytics.

Sub-processor 6: Cloudflare

Company’s full name: Cloudflare, Inc.

Company reg. number (or equivalent): 27-0805829

Company address (incl. country): 101 Townsend Street, San Francisco, California, 94107, USA

Other addresses which process personal data: Data centers worldwide (with a strong presence in Europe)

Contact person at sub-processor: [email protected]

Does the Data Processor have an agreement with the sub-processor which fulfils the requirements of the Data Processing Agreement?: Yes

Data processing which the sub-processor participates in: Content delivery network (CDN), web traffic protection, and DNS services. Protects against cyber-attacks.

Categories of personal data processed by the sub-processor: IP addresses, web traffic data, usage statistics, and security-related logs.

Sub-processor 7: Clicky (Roxr Software Ltd)

Company’s full name: Roxr Software Ltd (Clicky Analytics)

Company reg. number (or equivalent): 395315-95

Company address (incl. country): 10883 SE Main Street, Suite 201, Milwaukie, Oregon 97222, USA

Other addresses which process personal data: None

Contact person at sub-processor: [email protected]

Does the Data Processor have an agreement with the sub-processor which fulfils the requirements of the Data Processing Agreement?: Yes

Data processing which the sub-processor participates in: Anonymized web analytics, traffic monitoring. Hosted in EU data centers.

Categories of personal data processed by the sub-processor: IP addresses, anonymized session data.

Sub-processor 8: Stripe

Company’s full name: Stripe inc

Company reg. number (or equivalent): 4675506

Company address (incl. country):  South San Francisco, 354 Oyster Point Blvd, United States.

Other addresses which process personal data: None

Contact person at sub-processor: [email protected]

Does the Data Processor have an agreement with the sub-processor which fulfils the requirements of the Data Processing Agreement?: Yes

Data processing which the sub-processor participates in

Categories of personal data processed by the sub-processor: IP addresses, session data, name, email and credit card details for payments (only for users who purchase plans through the app, not applicable for enterprise who buy through invoices).

Sub-processor 9: Sentry

Company’s full name: Functional Software, Inc.

Company reg. number (or equivalent): 5214647

Company address (incl. country): 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA

Other addresses which process personal data:

Contact person at sub-processor: [email protected]

Does the Data Processor have an agreement with the sub-processor which fulfils the requirements of the Data Processing Agreement?: Yes

Data processing which the sub-processor participates in: Sentry processes error logs, performance monitoring data, and relevant customer data for developers to analyze app performance. It collects event data for debugging and error resolution purposes.

Categories of personal data processed by the sub-processor: IP addresses, session data, and user-related data such as names and emails for tech support.