Legal
Sub-processors and other recipients
Last updated: 2026-09-25
This list identifies the providers and other recipients that support the Service. A sub-processor processes customer personal data on our behalf under data-processing obligations. Providers may also act as independent controllers for their own account, security, regulatory, or platform purposes, as explained in their terms. Listing a provider here does not mean that all its processing is solely on our instructions.
We notify customer organisations by email at least 7 days before adding or replacing a sub-processor of customer personal data. We update this list ahead of the effective date. The objection procedure below applies to those sub-processor changes.
Providers, purposes, and regions
| Provider | Purpose and role | Region | Terms |
|---|---|---|---|
| Hetzner Online GmbH | Application hosting and object storage, including video recordings when enabled. Processor for hosted customer data. | EU hosting used for the Service. | Data protection and processing agreement |
| Cloudflare, Inc. | DNS and inbound email forwarding. Processor for data covered by its customer DPA; its own account processing is governed by its privacy policy. | Global, including the US. | Customer DPA |
| Stripe Payments Europe, Limited | Subscription payments. Processor for certain payment processing; independent controller for purposes including fraud prevention and legal compliance. | Ireland; transfers to Stripe, LLC in the US and other locations used by its affiliates and providers. | DPA and roles |
| Mapbox, Inc. | Map rendering and geocoding. Customer data processing is covered by its DPA; service-related data is also described in its product privacy policy. | US and global delivery infrastructure. | DPA · Product privacy policy |
| Plus Five Five, Inc. (Resend) | Transactional email delivery as processor. Independent controller for its account and usage data as described in its DPA. | US; other locations used by its sub-processors. | DPA |
| Apple (Apple Push Notification service) | iOS push notification delivery. Device tokens and notification payloads pass through Apple infrastructure. Apple platform processing is subject to its applicable terms and privacy policy. | Ireland, US, and other countries where Apple processes data. | Apple privacy policy |
| Google (Firebase Cloud Messaging) | Android push notification delivery. Processor for customer personal data under Firebase processing terms. | US and other countries with Google or sub-processor facilities. | Firebase processing terms |
Google Ads is a separate advertising recipient on the public marketing website, used only with advertising consent. It is not a sub-processor of customer operational data. Its processing is described in section 9 of the Privacy Policy.
Sign in with Google is an optional sign-in method. The user authenticates with their own Google account, and Google reports that account's identifier, email address, verification status and name to us. Google acts as the identity provider the user chose and as an independent controller for that sign-in, under the Google terms applying to that account. It does not process customer personal data on our behalf, so it is not a sub-processor, and the 7-day notice and objection procedure on this page do not apply to it. Data may be transferred to the United States and other countries under the EU–US Data Privacy Framework, to which Google LLC is certified, or the European Commission's Standard Contractual Clauses. What we receive and keep is described in section 2 of the Privacy Policy.
International transfers and safeguards
Hosting in the EU does not mean all providers keep all data in the EU. The regions above describe relevant processing locations, not a guarantee of exclusive storage in a named country. The following provider provisions describe the safeguards for transfers outside the European Economic Area (EEA):
- Hetzner: the Service uses EU hosting; its linked data-protection information explains the available processing agreement and locations.
- Cloudflare: section 6 of its linked customer DPA incorporates SCCs for restricted EEA transfers, with the appropriate controller-to-processor or processor-to-processor module.
- Stripe: its Data Transfers Addendum provides for the EU–US Data Privacy Framework for covered transfers to Stripe, LLC and SCCs as the alternative under the conditions stated there.
- Mapbox: Schedule C of its linked DPA contains SCCs for international transfers.
- Resend: section 6 of its linked DPA incorporates SCCs for transfers not covered by an adequacy decision; section 11 describes its Data Privacy Framework commitments.
- Google Firebase: section 10 of the linked terms provides for the Data Privacy Framework for transfers to covered certified US entities and SCCs where the specified transfer solution is unavailable.
- Apple: its linked privacy policy describes SCCs for international transfers of EEA personal data and how to request a copy from Apple. That policy is not an APNs-specific data-processing agreement.
The applicable mechanism depends on the receiving entity, the data, and the scope of the relevant terms or adequacy decision. Required supplementary measures apply alongside contractual safeguards. To obtain information about the safeguards used for your data or a copy, contact privacy@wetapoint.com. We may redact unrelated commercial information and third parties' personal data where necessary while preserving the information needed to understand those safeguards.
Objecting to a sub-processor
If you have a reasonable data-protection objection to a sub-processor, email privacy@wetapoint.com. If we cannot accommodate your objection, you may terminate with a pro-rated refund as set out in the Data Processing Agreement.