Version 2026-07-10 · provider: Minerics UG (haftungsbeschränkt), HRB 768686
Sub-processor. Workers compute/CDN, D1 database and backups, R2 object storage, KV, security and optional Turnstile. Data: Request/network metadata, tenant/account records, Customer content, visitor gate/activity records, authentication records. Locations: Global edge and provider infrastructure; resource and account settings affect storage/processing location. Transfer: Cloudflare DPA v6.4 supplies contractual transfer terms and supplementary measures; verify the applicable service, recipient, DPF scope or SCC module for the actual flow. Enablement: Required infrastructure; Turnstile only when both Turnstile keys are configured. Contract review: reviewed, 2026-07-10, https://www.cloudflare.com/cloudflare-customer-dpa/. DPA version 6.4 and current sub-processor notice terms reviewed; account acceptance and service settings require operator evidence.
Sub-processor. Transactional verification, access, password-reset, magic-link and operational email. Data: Recipient email, plain-text transactional message, delivery metadata. Locations: United States and locations in Resend's current subprocessor list. Transfer: Conditional US transfer. Apply Resend's current DPA and the fact-specific Chapter V mechanism; do not treat its clauses as coverage for other providers. Enablement: Only when RESEND_KEY is configured. Contract review: conditional-review, 2026-07-10, https://resend.com/legal/dpa. Public DPA and subprocessor notice path reviewed; operator must retain account acceptance and tracking-off evidence before enablement.
Processor for merchant service metadata; separate independent-controller/Merchant-of-Record activity may apply to buyer payments. Subscription checkout, entitlement events, customer portal and statutory payment administration. Data: Tenant ID, subscription/product status, merchant/customer metadata supplied to Polar, buyer/payment data collected by Polar. Locations: United States and locations in Polar's current subprocessor/payment-partner lists. Transfer: Conditional US processing. Review the DPA/SCC module for processor flows and Polar's separate role for buyer payment/legal activity. Enablement: Only when all Polar production secrets/product configuration are present. Contract review: conditional-review, 2026-07-10, https://polar.sh/legal/data-processing-addendum. DPA dated 2026-06-09 and subprocessor list reviewed; Merchant-of-Record role is not described as pure sub-processing.
Sub-processor. Optional allowlisted MCP control-plane product analytics. Data: Pseudonymous tenant distinct ID, tool/flow category, outcome, bounded counts and duration. Locations: EU Cloud endpoint configured; PostHog, Inc. and authorised support/subprocessors may create separately assessed access or transfers. Transfer: EU endpoint is not proof that no Chapter V transfer exists. Confirm the executed DPA, current subprocessors, access locations and transfer tool before enablement. Enablement: Only when POSTHOG_PROJECT_TOKEN is configured; never receives hosted visitor content or raw MCP arguments. Contract review: conditional-review, 2026-07-10, https://posthog.com/privacy. EU host and public privacy/security materials reviewed; retain executed account DPA and current subprocessor schedule before pilot enablement.
Conditional support email service provider. Receive and route correspondence voluntarily sent to support@sendhey.app. Data: Sender address, support correspondence and voluntarily supplied attachments/context. Locations: Provider infrastructure and support locations described in current account/legal materials. Transfer: Support may create a third-country disclosure; minimise case content and verify the account contract/transfer mechanism before external pilot support. Enablement: When a person sends support correspondence to the configured Namecheap Private Email alias. Contract review: conditional-review, 2026-07-10, https://www.namecheap.com/legal/general/privacy-policy/. Privacy terms reviewed; operator must retain the applicable business email contract/DPA evidence before external support data is accepted.
Contact support@sendhey.app. This operational baseline is not a legal-compliance certification.
About · Privacy · Legal notice · Report illegal content · Terms · DSA