We notify customers 30 days in advance of any new sub-processor that processes personal data. You may object in writing.
Transfers to providers outside the EU/EEA rely on EU Standard Contractual Clauses (Art. 46 GDPR) or, where the provider is certified, the EU-US Data Privacy Framework (Art. 45 GDPR).
| Vendor | Purpose | Data | Seat / region | DPA |
|---|---|---|---|---|
| Cloudflare, Inc. | Hosting of the web app (Pages) and the MCP gateway (Workers, Durable Objects, KV), bot protection (Turnstile), website checker (Durable Objects in the EU jurisdiction, Browser Rendering) | All requests to the platform, including account and ad-account data | USA (provider); global data-centre network | Link |
| Neon Inc. | Primary Postgres database | All stored platform data | EU, AWS eu-central-1 (Frankfurt) | Link |
| Anthropic PBC | AI analysis (audits, recommendations, chat) when no customer AI key is stored | Chat inputs, metrics and structure of connected advertising and analytics accounts | USA | - |
| Voyage AI | Matching requests against the internal knowledge base (embeddings, reranking) | Request text and internal knowledge-base texts | USA | - |
| Serper.dev | Web search for competitor and market research in agency mode | Search terms (personal details removed before sending) | Outside the EU/EEA | - |
| Inngest Inc. | Background jobs (audits, recommendation refresh, billing events) | Job parameters such as workspace and account identifiers | USA (provider) | Link |
| Stripe Payments Europe Ltd. | Subscriptions, invoices, tax calculation, customer portal | Billing and payment data | Ireland (EU); Stripe, Inc. (USA) | Link |
| Resend Inc. | Transactional email (sign-in links, confirmations, audit reports) | Name, email address, email content | USA | Link |
Not sub-processors
In the following cases the legal relationship runs directly between you and the provider:
- Anthropic, OpenAI, Google (Gemini), mit eigenem Schlüssel / with your own key (BYOK): If you store your own AI key, Helferlain sends requests to the provider using that key. Your own contract with the AI provider governs that processing.
- Google (Ads, Analytics, Search Console, Google-Anmeldung), Meta, Zoho Bigin: Platforms you connect yourself via OAuth. Their own terms apply; Helferlain reads and (only at your instruction) writes on your behalf.