Subprocessor List#
Last updated: 1 August 2026
This English translation is provided for convenience only. The German version is the legally binding version and prevails in case of discrepancies.
This page is the public, current list of subprocessors of Flenski FZCO within the meaning of Section 9.2 of the Data Processing Agreement (DPA). Its content is identical to Annex 3 of the DPA and to the description of recipients in Section 20 of the Privacy Policy.
Subprocessors of the Platform#
The main processing of personal data takes place on servers within the EU (currently Germany). The following service providers are used in a supporting role:
| Service provider | Registered office | Place of processing | Purpose | Data categories | Transfer basis |
|---|---|---|---|---|---|
| Hetzner Online GmbH | Germany | Germany | Hosting of the platform, of Flenski's own AI server, and of the self-hosted error analysis (Sentry instance) | all platform data | — (EU) |
| Cloudflare, Inc. | USA | EU/worldwide (edge network); processing in the USA possible | DDoS protection, CDN, delivery and security of the platform | Technically required connection and request data, in particular IP addresses | EU-U.S. Data Privacy Framework — Cloudflare, Inc. holds an active certification (adequacy decision, Art. 45 GDPR); as a fallback, Standard Contractual Clauses (Art. 46(2)(c) GDPR) under the Cloudflare DPA together with supplementary measures |
| BUNNYWAY d.o.o. | Slovenia | Germany/EU (contractually restricted) | Media storage and delivery | Media content, delivery data | — (EU) |
| Kloppe Media GmbH (smsflatrate.de), Ansbacher Str. 85, 91541 Rothenburg ob der Tauber | Germany | Germany | Sending one-time codes via SMS | Phone number, message content (one-time code) | — (EU) |
| Mailgun Technologies, Inc. (Sinch Group), 112 E. Pecan Street #1135, San Antonio, Texas 78205 | USA | EU (EU region selected; EU data centers including in Germany) | Email delivery for workspaces without their own SMTP access (primary delivery service) | Email addresses, names, email content | Processing within the EU (EU region selected); for any residual access by the US parent company: EU-U.S. Data Privacy Framework — Mailgun Technologies, Inc. is certified (Art. 45 GDPR); as a fallback, Standard Contractual Clauses under the Sinch Email DPA |
| Elastic Email Inc., Unit 107, 1208 Wharf Street, Victoria, BC V8W 3B9 | Canada | EU (EU region selected) | Email delivery for workspaces without their own SMTP access (backup delivery service) | Email addresses, names, email content | Processing within the EU (EU region selected); otherwise the EU Commission's adequacy decision for Canada (Decision 2002/2/EC, limited to commercial organizations subject to PIPEDA); as a fallback, Standard Contractual Clauses under the Elastic Email DPA |
| Google Ireland Limited (Firebase Cloud Messaging; contracting entity for the EEA), Gordon House, Barrow Street, Dublin 4 | Ireland; data also processed by Google LLC (USA) | EU/worldwide; processing in the USA possible | Delivery of web push notifications (including when installed as a PWA) | Push tokens, notification content (may contain personal content, e.g. message excerpts), technical delivery data | EU-U.S. Data Privacy Framework — Google LLC, including its wholly owned US subsidiaries, holds an active certification (Art. 45 GDPR); additionally, Standard Contractual Clauses (Art. 46(2)(c) GDPR) under the Firebase Data Processing and Security Terms |
Not a Subprocessor#
Error analysis (Sentry) runs as a self-hosted instance on our own Hetzner infrastructure in Germany and is therefore not an external subprocessor. Services that a Creator connects independently (their own payment providers, their own AI providers via API key, MCP clients, their own SMTP, their own trackers) are recipients or the respective Creator's own processors — not subprocessors of Flenski.
Changes to This List#
Flenski informs Creators of intended changes — in particular the addition or replacement of a subprocessor — in text form with at least four weeks' notice before the change takes effect (Section 9.3 of the DPA). Creators may object to the change within two weeks for important reasons related to data protection law (Section 9.4 of the DPA).
Questions about this list: finn@flenskiteam.com