Legal · Sub-processors
Sub-processors
Every third-party vendor that processes personal data on our behalf, what they do, and where they run. Verified against the codebase; updated on every change.
§ 1. What a sub-processor is
- A sub-processor is a third-party vendor engaged to process personal data on the Operator's behalf — infrastructure, payments, email delivery, error monitoring, product analytics.
- Each sub-processor is bound by a written agreement passing the Operator's obligations under Regulation (EU) 2016/679 (GDPR) through to it.
- Before a sub-processor is engaged, the Operator reviews: a) its security posture and available certifications (SOC 2 Type II, ISO 27001, or equivalent); b) its data-transfer terms — Standard Contractual Clauses for EU ↔ non-EEA flows; c) its breach-notification commitments, which must be no slower than the Operator's own; d) whether it is appropriate for a service that some children use.
§ 2. Current sub-processors
| Vendor | Purpose | Data category | Region | Data-protection status |
|---|---|---|---|---|
| Hetzner Online GmbH | Managed hosting, PostgreSQL database, server-side file storage, backups | Account data, operational content, uploaded files, backups | Germany | Data-processing agreement + EU Standard Contractual Clauses where they apply |
| Cloudflare, Inc. (R2 object storage) | Storage of files and voice messages sent in chat, which are short-lived and expire | The file itself and its name, for as long as it lives | European Union | Cloudflare DPA + Standard Contractual Clauses |
| Stripe Payments Europe, Ltd. | Payment processing (provider subscriptions only) | Payment method, billing address, tax ID, transaction metadata | Ireland / EU | Stripe DPA + Standard Contractual Clauses |
| Google LLC (Calendar API, Drive API) | Calendar synchronisation, references to files a provider stores in their own Drive | OAuth tokens, calendar-event metadata, Drive file identifiers and metadata. When someone opens a shared Drive file, its contents pass through the Operator's servers to reach them; no copy is kept | User's Google region | Google Workspace DPA covers this OAuth use; SCCs apply for transfers to Google servers outside the EEA |
| Resend, Inc. | Transactional email delivery (sign-in, notifications, invoices, security alerts) | Recipient email address, email body content | EU (eu-central) |
Resend DPA + Standard Contractual Clauses |
| Sentry (Functional Software, Inc.) | Error and performance monitoring, on user opt-in only | Stack traces with request context, redacted user identifiers | EU (sentry.io EU region) |
Sentry DPA + Standard Contractual Clauses |
| PostHog Inc. | Anonymous product analytics, on user opt-in only | De-identified session events, page views, feature usage | EU (eu.i.posthog.com) |
PostHog DPA + Standard Contractual Clauses |
§ 3. Status legend
- DPA in place — a data-processing agreement compliant with art. 28 GDPR is signed with the vendor.
- SCCs — Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) form part of the vendor agreement, used where the vendor processes data outside the EEA.
- Opt-in only — off by default; activated only after the user accepts the corresponding cookie category or feature toggle.
§ 4. Vendors deliberately not used
- No advertising networks.
- No cross-site-tracking vendors — no pixels, no fingerprinting scripts, no retargeting.
- No third-party consent-management platform. The cookie banner is served by the Operator's own front-end and lists only vendors actually in use.
§ 5. Changes to this list
- Where a sub-processor is added or replaced, this page is updated before that sub-processor begins processing personal data, so that a Controller has the opportunity to object required by art. 28(2) GDPR.
- Where a sub-processor is removed, this page is updated once the migration away from it is complete.
- This page is the notice. There is no separate mailing list, and no undertaking to give a fixed number of days' warning — an undertaking of that kind is kept by a person remembering it, and it fails silently. What is enforced instead is that the list is complete: the build fails if a vendor processes data without appearing here.
§ 6. Objecting to a sub-processor
- Where a sub-processor is materially incompatible with a Controller's data-protection requirements, the Controller may object by writing to privacy@relentu.com.
- The Operator will work with the Controller in good faith either to provide an alternative configuration, where one exists, or to wind the workspace down on reasonable terms, with a pro-rata refund of unused prepaid fees.
§ 7. Contact
- Questions about any sub-processor: privacy@relentu.com.
- The version of this list in force, and the date on which it took effect, are displayed on this page. It is effective as of 2026-08-01.