Sub-processors
Last updated: 29 October 2026
DRAFT — NOT YET IN FORCE. A practising Irish solicitor or privacy adviser should review this list before publication. Facts in [CAPITALS] must be checked against each provider's current terms.
These are the third parties that process personal data for Grafkit. Each works under a written contract with data protection terms that meet Article 28 of the GDPR. Where data leaves the European Economic Area, the safeguard is shown.
We give clients at least 30 days' notice before adding or replacing a sub-processor that handles client content. To get notice by email, write to [email protected].
Infrastructure and app
| Provider | Purpose | Data location | Safeguard for transfers |
|---|---|---|---|
| Hetzner Online GmbH (Germany) | App servers, database, backups and Storage Box | Germany | EU — none needed |
| Cloudflare, Inc. (US) | Content delivery, DNS, security (DDoS, firewall), file storage (R2, EU jurisdiction), email routing for our domains | R2 files stored in the EU; network traffic handled at the nearest edge location worldwide | EU–US Data Privacy Framework; Standard Contractual Clauses |
| Anthropic Ireland, Limited | AI helpers in the app (brief helper, brief writer, brand assistant). Not used to train AI models. | United States | SCCs (Module 2/3) |
| Resend (Plus Five Five, Inc., US) | Sending sign-in links, notifications and receipts by email | United States | DPF; SCCs |
Business operations
| Provider | Purpose | Data location | Safeguard for transfers |
|---|---|---|---|
| Stripe Payments Europe, Ltd. (Ireland) | Payments, subscriptions, invoices and tax calculation. Stripe is also an independent controller for fraud prevention and its legal duties. | Ireland and the United States | DPF; SCCs; Binding Corporate Rules |
| Google Ireland Limited / Google LLC | Email (Gmail): receiving and forwarding mail to our hello@ addresses | EU and United States | DPF; SCCs |
| VBOUT, Inc. — planned, not yet in use | Marketing email and contact management | United States | SCCs |
Our websites
| Provider | Purpose | Data location | Safeguard |
|---|---|---|---|
| Google Fonts (Google LLC) | Web fonts loaded by your browser when you visit our sites; Google receives your IP address | Global | DPF; SCCs |
Changes
| Date | Change |
|---|---|
| 29 October 2026 | First published list |
Terms · Privacy · Cookies · Sub-processors · Company details · Accessibility ·