Subprocessors
Version 2026-11-10.a7056505
Last updated: 2 November 2026
1. What this page lists
1.1 A subprocessor is a company we use to process the personal data in your apps for you. Under our data processing agreement, you allow us to use the subprocessors in section 2.
1.2 Section 3 lists other companies that receive personal data from us for their own purposes, which our privacy policy covers. Section 4 lists services you connect to Clusterz yourself. Section 5 covers the apps we offer.
1.3 Our error tracking runs on our own servers, and no outside company receives error reports. The Clusterz assistant is separate: section 2 says who handles what you type into it.
2. Subprocessors
| Company | What it does for us | Data it handles | Where |
|---|---|---|---|
| Hetzner Online GmbH, Gunzenhausen, Germany | Provides the servers that host your apps and Clusterz, the object storage for your apps' files, backups, app images and logs, and our name servers | All the data in your apps, their backups and their logs | Germany |
| Google Cloud EMEA Limited, Dublin, Ireland (Google Cloud) | Key service (Cloud KMS) that protects the keys encrypting your backups | Backup keys, while it wraps or unwraps them. No data from your apps. | Frankfurt, Germany |
| Google Cloud EMEA Limited, Dublin, Ireland (Google Workspace) | Our email, including contact@clusterz.eu and the billing emails we send, and our staff chat | Emails you send us. Billing emails to owners and admins, with the team's credit and its plan or bundle. Alerts to our staff that identify your team and app, give the cause of a failure in our own systems and, in an outage, the app's web address. Notices of help requests to our staff: IDs, the kind of request and the address to reply to. | Europe, under the data region we set in Google Workspace |
| Anthropic, PBC, San Francisco, United States | Runs Claude, its AI model, for the Clusterz assistant | What people type into the assistant and its earlier replies in the same chat, and the account facts it reads: role, which bundles the team has, when its free trial ends, how many apps and members it has, the software each app runs and its state, a failed step's kind and time, whether it ran out of time, whether the app is up, the last backup's time and state, whether the team's credit is below zero and the date its apps pause. It cannot read your apps. | United States |
2.1 Where Google moves data out of the European Economic Area, it relies on the EU-US Data Privacy Framework, under which Google LLC is certified, and on the European Commission's standard contractual clauses.
2.2 Anthropic, PBC is in the United States. The European Commission's standard contractual clauses, in Anthropic's data processing addendum, cover what it receives from us, and Anthropic may not train its models on it.
3. Other companies that receive personal data from us
3.1 Revolut Bank UAB, Lithuania, takes payments for credit. It receives the payer's email address, the amount and a reference, and acts under its own privacy notice. The payment form loads from Revolut in the payer's browser, so Revolut also receives what a browser sends when it loads a page, such as its IP address.
3.2 Internet Security Research Group (Let's Encrypt), United States, issues the security certificates for web addresses on Clusterz. About you and your apps, it receives domain names only, including your own domains. These then appear in public certificate logs, as every public certificate does.
3.3 CrowdSec SAS, 20 rue Maurice Arnoux, 92120 Montrouge, France, runs a shared list of attacking addresses. Its software runs on our servers, and is set up to read our router's logs, detect attacks on Clusterz and your apps and, where we enable it, block the addresses they come from.
- For each attack it detects, the software sends CrowdSec SAS the address, its location when available, the kind of attack and the time. It sends no logs.
- CrowdSec SAS acts on its own account. It says it is a joint controller of this data with those who send it, and it is not our subprocessor.
- It says it keeps an address as such for at most 3 months and then blurs it, and that some data can stay up to a year before it is anonymised.
- It says it uses Amazon Web Services and Google Cloud, and that it relies on the European Commission's standard contractual clauses for transfers outside the EU.
4. Services you connect yourself
4.1 You sign in with Google, Apple, GitHub, GitLab or Bitbucket, as our sign-in page offers, and you connect your repositories from GitHub, GitLab or Bitbucket.
4.2 These are not our subprocessors. You hold your own account with each, and its terms and privacy notice apply. We receive your profile from them, read your repositories as you allow, and add and remove the notifications that tell us when your code changes.
4.3 GitHub, Inc. and GitLab Inc. are in the United States and are certified under the EU-US Data Privacy Framework. Bitbucket is run by Atlassian, whose privacy policy names Atlassian Pty Ltd in Australia and Atlassian, Inc. in the United States. Atlassian says it relies on the Data Privacy Framework, under which Atlassian, Inc. is certified, and on standard contractual clauses. Google's sign-in service comes from Google LLC, which is certified under the Data Privacy Framework. Apple says it relies on standard contractual clauses.
5. The apps we offer
5.1 The apps we offer are made by others, and each works as its maker designed it. Some contact their makers or other services by themselves, for example to check for updates, fetch notices, send usage figures or error reports, load fonts, maps or site icons, or relay mobile notifications. Each app's own documentation describes what it does.
5.2 Those companies are not our subprocessors. You choose which apps to install.
6. Changes and objections
6.1 We email the owners and admins of every team at least 30 days before we add or replace a subprocessor, or change where one keeps your data or what it does for us, and we update this page.
6.2 You can object by email to contact@clusterz.eu before the change applies, as section 7 of the data processing agreement describes.
7. Change history
| Date | Change |
|---|---|
| 2 November 2026 | First version |
| 2 November 2026 | Hetzner's object storage also holds the files your apps keep there, in Falkenstein, with a nightly copy in Nuremberg |
| 2 November 2026 | Added Anthropic, which runs the AI model behind the Clusterz assistant, and notices of help requests to our staff |