This page lists the service providers (processors or independent controllers) we use to operate malahov.io and its products. Details on each processing activity can be found in the Privacy Policy.
| Provider | Purpose / data processed | Location / processing region | Legal basis & transfer |
|---|---|---|---|
| Hetzner Online GmbH | Hosting (servers, databases), server logs/IP addresses | Germany (Falkenstein/Nuremberg) | EU only; DPA (Art. 28 GDPR); Art. 6(1)(b)/(f) GDPR |
| Stripe Payments Europe, Ltd. | Payment processing for Pro subscriptions (checkout, subscriptions, customer portal); we store no card data | Ireland (EU); partly Stripe, Inc. (USA) | Art. 6(1)(b) GDPR; US transfer: SCCs (Art. 46 GDPR) + EU-US Data Privacy Framework; partly independent controller (fraud prevention) |
| Google Cloud EMEA Ltd. — Vertex AI | AI processing for dictation (transcription, cleanup, translation) and the subtitle editor (text features); audio/text per request, zero retention | EU region europe-west4 (Netherlands) | Art. 6(1)(b) GDPR; Google Cloud DPA + SCCs |
| Deepgram, Inc. | Audio transcription in the subtitle editor; EU endpoint (api.eu.deepgram.com), model-improvement opt-out | US company; processing in EU data centers | Art. 6(1)(b) GDPR; SCCs (Art. 46 GDPR) |
| Plus Five Five, Inc. (Resend) | Email delivery: sign-in codes, confirmations, subscription and lifecycle messages, newsletter; email address, subject, body, delivery logs | US company; sending through the EU region eu-west-1 (Ireland) | Art. 6(1)(b) or (a) GDPR; Resend DPA with SCCs (Art. 46 GDPR); open and click tracking disabled |
| Cal.com, Inc. | Appointment booking via the booking page we link to; name, email address, time zone, what you write about your request, appointment data | USA | Art. 6(1)(b) GDPR (pre-contractual steps); Cal.com DPA with SCCs (Art. 46 GDPR) |
Self-hosted (no third parties): web analytics (Umami, cookieless, on our Hetzner infrastructure), authentication (Better Auth), and file storage run on our own infrastructure and are not sub-processors in the strict sense.
Conditionally active: sign-in via Google (OAuth) — Google Ireland Limited — is only used where it is offered on the sign-in page.
Changes to this list are published on this page; the date of the last update is shown above.