Processors
Full list of service providers involved in processing your data. · Deutsche Version
Processors are selected to meet Art. 28 GDPR requirements. All transfers to third countries (notably the US) are covered by Standard Contractual Clauses (SCCs) per EU Commission Decision 2021/914.
Supabase Inc.
- Location:
- USA (database in EU — Frankfurt)
- Purpose:
- Authentication, storage of profile, corrections, red-pen transactions
- Transfer basis:
- EU data residency, EU Commission SCCs (2021/914)
- Retention:
- until account deletion; audit logs 30 days
Vercel Inc.
- Location:
- USA (edge functions in EU)
- Purpose:
- API hosting (Next.js server)
- Transfer basis:
- EU data residency, SCCs
- Retention:
- request logs 30 days
- DPA:
- vercel.com/legal/dpa
Anthropic PBC
- Location:
- USA
- Purpose:
- AI correction (Claude Sonnet)
- Transfer basis:
- SCCs, Anthropic API Terms §B.5 (no training on API data)
- Retention:
- 30 days for abuse monitoring, then deletion
Stripe Payments Europe, Ltd.
- Location:
- Ireland / USA
- Purpose:
- Web payments, Stripe Checkout, payment confirmation for red-pen grants
- Transfer basis:
- SCCs, Stripe DPA
- Retention:
- purchase and invoice data 7 years (tax retention)
- DPA:
- stripe.com/legal/dpa
Resend (Resend Inc.)
- Location:
- USA (email delivery in EU — Ireland)
- Purpose:
- Transactional email (account confirmation, password reset)
- Transfer basis:
- EU data residency, SCCs
- Retention:
- email logs 30 days
- DPA:
- resend.com/legal/dpa
Changes
This list is continuously updated. For material changes (new sub-processor, change of data residency) we notify active users by email 30 days in advance.