← Back to Legal
This is a non-binding English courtesy translation. The legally binding version is the German original.
Sub-Processor Register
In accordance with Art. 28 GDPR, we maintain a register of all sub-processors that process personal data as part of our services. This register is updated regularly. Last updated: August 2026.
| Service | Company | Location | Purpose | Data Processed | DPA Status |
|---|---|---|---|---|---|
| Vercel (Hosting) | Vercel Inc. | San Francisco, USA | Website and application hosting | IP address, user agent, access logs | Standard Contractual Clauses (SCCs) |
| Vercel Analytics | Vercel Inc. | San Francisco, USA | Cookieless website analytics | Page views, Core Web Vitals (anonymized) | SCCs (via Vercel DPA) |
| Vercel KV (Upstash) | Upstash Inc. | USA (EU data processing) | Rate limiting for abuse protection | Hashed IP addresses (TTL 24h) | SCCs (via Vercel DPA) |
| Resend | Resend Inc. | San Francisco, USA | Transactional email delivery | Email address, name | SCCs |
| Google Workspace | Google Ireland Ltd. | Dublin, Ireland | Email, calendar, video conferencing | Name, email address, calendar events, video call data | SCCs + Google Data Processing Terms |
| Domonda | DOMONDA GmbH | Vienna, Austria; servers in Germany and Austria | Accounting preparation, document archiving and payment reconciliation | Invoices, accounting documents, business and payment data | DPA pursuant to Art. 28 GDPR |
| Anthropic (Claude API) | Anthropic PBC | San Francisco, USA | AI-powered chat assistant on the website; AI-assisted qualitative research analysis (transcript analysis, report generation); AI-assisted studies (interviews, surveys) | Chat messages (user input), research transcripts and participant statements, IP address (rate limiting) | SCCs + Zero Data Retention API |
| LiveKit (Video Infrastructure) | LiveKit Inc. | USA | WebRTC-based video and audio transmission for remote user studies (UX tests, interviews). Processing of video/audio streams, session tokens, and recordings. | Video/audio streams, participant identity (name, role), session metadata, recordings | SCCs |
| Supabase | Supabase Inc. | EU (Ireland) | Database and authentication | User account, profile data, study data | DPA signed, EU hosting (Ireland) |
| Voyage AI | Voyage AI Inc. | San Francisco, USA | Text embeddings for knowledge retrieval (RAG) | Document text chunks, chat queries | SCCs |
| IONOS | IONOS SE | Montabaur, Germany | Domain registration and DNS management | Domain WHOIS data (name, address of domain holder) | DPA (German company, GDPR-native) |
| Cloudflare Turnstile | Cloudflare, Inc. | USA | Bot protection for form submissions | IP address, browser fingerprint, interaction data | EU-US Data Privacy Framework |
| IGDB API & CDN | Twitch Interactive, Inc. (Amazon.com, Inc.) | USA | Game search and cover images for profiling | Search terms, IP address (CDN) | EU-US Data Privacy Framework |
| Steam Web API & OpenID | Valve Corporation | Bellevue, WA, USA | Steam account connection and game library import | SteamID64, game library, playtime data | EU-US Data Privacy Framework |
Change Log
- March 2026: Initial publication
- April 2026: Added IGDB (Twitch/Amazon) and Steam (Valve)
- April 2026: Added Cloudflare Turnstile
- April 2026: Added LiveKit; expanded Anthropic entry to cover AI-assisted research analysis and AI-assisted studies
- August 2026: Added Domonda; retired the PDF export in favor of this continuously maintained web register
- August 2026: Removed PostHog; web analytics and the cookie banner discontinued without replacement, error and performance measurement now first-party on our own infrastructure
Contact
For questions about our sub-processors, contact us at marc.busch@user-feedback.at