Sub-processors
Draft: text not yet reviewed by a lawyer.
1. What this list is C01
This is the list of the providers (sub-processors) that process personal data on behalf of to provide Codelux AI, with the purpose, the data involved, the location and the safeguards for transfers outside the EEA. It is part of the privacy policy and of the data processing agreement. The table at the end of the page is generated from the declarations of the product and is always the current one.
2. Changes and notice C02
When we add or replace a sub-processor we publish a new version of this list. The Organisations that accepted the data processing agreement are told by email to the owner before the change takes effect, with the notice stated in the DPA. Every version stays available with its date.
3. Right to object C03
An Organisation that accepted the data processing agreement may object to a new sub-processor within the notice period, on reasonable data protection grounds, by writing to . What happens next is set out in the DPA.
List of sub-processors
| Name | Purpose | Data | Where | Safeguards |
|---|---|---|---|---|
| Stripe Payments Europe Ltd. (Stripe, Inc.) | Payment processing, subscriptions and refunds. | Billing name and address, email, tax identifiers, payment method data entered on Stripe's checkout page, payment and subscription status. | Ireland (EEA); may be processed in the United States. | Data Processing Agreement; EU-US Data Privacy Framework and Standard Contractual Clauses for transfers to the United States. |
| Cloudflare, Inc. | DNS, CDN, reverse proxy and protection against abuse; R2 object storage for files and backups. | IP address, request headers and connection metadata of every visit; files and backups stored in R2. | Global edge network; R2 buckets in the EU jurisdiction. Company based in the United States. | Data Processing Addendum; EU-US Data Privacy Framework (certified) and Standard Contractual Clauses. |
| Kamatera, Inc. | Hosting of our servers and databases (virtual private servers). | All the data of the Service stored on our servers: account and organisation data, content, logs. | Frankfurt, Germany (EU). [TO BE CONFIRMED: data centre locations in production] | Data Processing Agreement; data kept in the EEA. |
| [TO BE CONFIRMED / DA CONFERMARE: email delivery (SMTP) provider] | Delivery of service emails (sign-in codes, security, billing, notices of new versions). The provider has not been recorded yet: the owner must confirm it. | Recipient email address, subject and content of the message. | [TO BE CONFIRMED] | [TO BE CONFIRMED] |