Subprocessors
3. Annex 2: Subprocessors
As of October 2026. We announce changes 30 days in advance (§ 6).
| Subprocessor | Registered office | Place of processing | Task | Data | When | Third-country basis |
|---|---|---|---|---|---|---|
| Hetzner Online GmbH | Gunzenhausen, Germany | Germany | Server, data center, off-site backup | all data on the server | always | not applicable |
| Cloudflare, Inc. | San Francisco, USA | global network, connection to the nearest location | Network, protection against attacks | traffic between app and server (forwarded encrypted) | whenever the server is contacted | EU-U.S. Data Privacy Framework, Standard Contractual Clauses |
| Deepgram, Inc. | San Francisco, USA | EU servers | Speech recognition (text while speaking) | voice recording | for every recognition through our server | processing in the EU; EU-U.S. Data Privacy Framework for access from the USA |
| Mistral AI SAS | Paris, France | EU servers | Speech recognition (inserted text), rewriting, editing, translating, questions, style analysis | voice recording, texts | for recognition and these features through our server | not applicable |
| Resend (Plus Five Five, Inc.) | San Francisco, USA | EU (Ireland) | Sending of account emails | email address, content of the account email | for account emails | EU-U.S. Data Privacy Framework |
| Functional Software, Inc. (Sentry) | San Francisco, USA | data region Frankfurt | Crash reports of the app | technical data without name, email, IP and without dictation content | App Store version | processing in the EU; EU-U.S. Data Privacy Framework for access from the USA |
Apple (Sign in with Apple, iCloud, notifications, App Store) is not a subprocessor: the user uses these services in the user’s own contractual relationship with Apple.
For providers based in the USA, transfers rely on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the provider is certified. These are Cloudflare, Deepgram, Resend and Sentry. Deepgram, Resend and Sentry process on servers in the EU; the Data Privacy Framework covers possible access from the USA.