← Back to Legal
This is a non-binding English courtesy translation. The legally binding version is the German original.
Sub-Processor Register
In accordance with Art. 28 GDPR, we maintain a register of all sub-processors that process personal data as part of our services. This register is updated regularly. Last updated: April 2026.
| Service | Company | Location | Purpose | Data Processed | DPA Status |
|---|---|---|---|---|---|
| Vercel (Hosting) | Vercel Inc. | San Francisco, USA | Website and application hosting | IP address, user agent, access logs | Standard Contractual Clauses (SCCs) |
| Vercel Analytics | Vercel Inc. | San Francisco, USA | Cookieless website analytics | Page views, Core Web Vitals (anonymized) | SCCs (via Vercel DPA) |
| Vercel KV (Upstash) | Upstash Inc. | USA (EU data processing) | Rate limiting for abuse protection | Hashed IP addresses (TTL 24h) | SCCs (via Vercel DPA) |
| PostHog | PostHog Inc. | EU (eu.i.posthog.com) | Product analytics and usage statistics | Pseudonymized usage data, click behavior, IP address (EU servers) | DPA signed, EU hosting |
| Resend | Resend Inc. | San Francisco, USA | Transactional email delivery | Email address, name | SCCs |
| Google Workspace | Google Ireland Ltd. | Dublin, Ireland | Email, calendar, video conferencing | Name, email address, calendar events, video call data | SCCs + Google Data Processing Terms |
| Anthropic (Claude API) | Anthropic PBC | San Francisco, USA | AI-powered chat assistant on the website; AI-assisted qualitative research analysis (transcript analysis, report generation); AI-assisted studies (interviews, surveys) | Chat messages (user input), research transcripts and participant statements, IP address (rate limiting) | SCCs + Zero Data Retention API |
| LiveKit (Video Infrastructure) | LiveKit Inc. | USA | WebRTC-based video and audio transmission for remote user studies (UX tests, interviews). Processing of video/audio streams, session tokens, and recordings. | Video/audio streams, participant identity (name, role), session metadata, recordings | SCCs |
| Supabase | Supabase Inc. | EU (Frankfurt) | Database and authentication | User account, profile data, study data | DPA signed, EU hosting (Frankfurt) |
| Voyage AI | Voyage AI Inc. | San Francisco, USA | Text embeddings for knowledge retrieval (RAG) | Document text chunks, chat queries | SCCs |
| IONOS | IONOS SE | Montabaur, Germany | Domain registration and DNS management | Domain WHOIS data (name, address of domain holder) | DPA (German company, GDPR-native) |
| Cloudflare Turnstile | Cloudflare, Inc. | USA | Bot protection for form submissions | IP address, browser fingerprint, interaction data | EU-US Data Privacy Framework |
| IGDB API & CDN | Twitch Interactive, Inc. (Amazon.com, Inc.) | USA | Game search and cover images for profiling | Search terms, IP address (CDN) | EU-US Data Privacy Framework |
| Steam Web API & OpenID | Valve Corporation | Bellevue, WA, USA | Steam account connection and game library import | SteamID64, game library, playtime data | EU-US Data Privacy Framework |
Change Log
- March 2026 — Initial publication
- April 2026 — Added IGDB (Twitch/Amazon) and Steam (Valve)
- April 2026 — Added Cloudflare Turnstile
- April 2026 — Added LiveKit; expanded Anthropic entry to cover AI-assisted research analysis and AI-assisted studies
Contact
For questions about our sub-processors, contact us at datenschutz@busch-labs.at