Legal
Sub-processors
Last updated: 2026-07-11
We engage the third-party sub-processors listed below to deliver the Service. Each is bound by contract to process personal data only on our instructions and to the standard required by applicable data-protection law.
Changes to this list will be notified to customer organisations by email at least 7 days before the change takes effect. The table below is updated ahead of the effective date.
Current sub-processors
| Sub-processor | Purpose | Region | Link |
|---|---|---|---|
| Hetzner Online GmbH | Application hosting and storage. | EU | hetzner.com |
| Cloudflare, Inc. | DNS and inbound email forwarding. | Global | cloudflare.com |
| Stripe Payments Europe, Ltd. | Subscription payments. | Ireland (EU) | stripe.com |
| Mapbox, Inc. | In-app map rendering and geocoding. | United States | mapbox.com |
| Resend Inc. | Transactional email delivery. | United States | resend.com |
| Apple Push Notification service | iOS push notification delivery. | United States | developer.apple.com |
| Google LLC (Firebase Cloud Messaging) | Android push notification delivery. | United States | firebase.google.com |
International transfers
A provider's region does not by itself determine the transfer mechanism. For any restricted transfer outside the EEA, we use the applicable safeguard in that provider's data-processing terms, such as an adequacy decision or recognised framework, or the European Commission's Standard Contractual Clauses. The UK Addendum and proportionate supplementary measures apply where required.
Objecting to a sub-processor
If you have a reasonable data-protection objection to a sub-processor, email privacy@wetapoint.com. If we cannot accommodate your objection, you may terminate with a pro-rated refund as set out in the DPA.