1. Sub-processors for customer data (DPA Annex 3)
| Entity | Service | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Váš Hosting s.r.o., Zbožská 1385/40, 288 02 Nymburk, Czech Republic, Company ID 24742252 | VPS hosting: servers, databases, e-mail server; nightly backups to separate external servers | all data stored in the Service (accounts, proofs and captured content, logs, e-mails) | Czech Republic (EU) | not needed (EU) |
| Stripe Payments Europe, Ltd. (Ireland) | payment of Assisted Capture orders | e-mail, payment data and order data (URLs and notes) | Ireland (EU); group transfers to Stripe, Inc. (USA) | Commission adequacy decision (EU) 2023/1795 (EU–US Data Privacy Framework); standard contractual clauses as a fallback |
| SK ID Solutions AS (Estonia) | qualified electronic timestamps (RFC 3161), qualified trust service provider | only the SHA-256 hash (pseudonymous; no content or customer identity is sent) | Estonia (EU) | not needed (EU) |
| Anthropic, PBC (USA) | AI fallback for cookie banners in server captures; enabled by default, can be switched off per capture ("Capture without AI"), never used in the "strict" profile | screenshot of the visible part of the captured page | USA | standard contractual clauses (Commission Implementing Decision (EU) 2021/914, Modules 2 and 3) incorporated in Anthropic's Data Processing Addendum |
2. Our processors for data we control
| Entity | Service | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Váš Hosting s.r.o. (Czech Republic) | VPS hosting: servers, databases, e-mail server; nightly backups to separate external servers | account, billing, licence, communication and log data | Czech Republic (EU) | not needed (EU) |
| Stripe Payments Europe, Ltd. (Ireland) | payments, invoices, Stripe Tax, customer portal | name, e-mail, billing address, VAT ID, payment and subscription data | Ireland (EU); group transfers to Stripe, Inc. (USA) | Commission adequacy decision (EU) 2023/1795 (EU–US Data Privacy Framework); standard contractual clauses as a fallback |
| Google Ireland Limited (Ireland) | Google Analytics 4 website analytics, only after consent | pseudonymous identifiers, usage and device data of website visitors | Ireland (EU); transfers to Google LLC (USA) | Commission adequacy decision (EU) 2023/1795 (EU–US Data Privacy Framework); standard contractual clauses as a fallback |
| Anthropic, PBC (USA) | AI tools we use to handle e-mail correspondence and business contacts | content of e-mails and contact data of business contacts | USA | standard contractual clauses (Commission Implementing Decision (EU) 2021/914, Module 2) incorporated in Anthropic's Data Processing Addendum |
3. Other recipients (not processors)
| Recipient | Why | Data |
|---|---|---|
| OpenTimestamps public calendar servers | anchoring of proofs in the Bitcoin blockchain | hashes only; no personal data |
| Public DNS resolvers (Cloudflare 1.1.1.1, Google 8.8.8.8, Quad9 9.9.9.9) and RDAP servers of domain registries | recording DNS and domain registration data of the captured page | the domain of the captured page; no customer data |
| Websites you ask us to capture | our browser loads the page | the IP address of our server and a standard browser request |
| WhatsApp Ireland Limited | only if you choose to contact us via WhatsApp (independent controller) | your phone number and messages |
| YouTube (Google) | video player, loaded only after you click play | IP address and browser data |
| GitHub and PyPI | only if you download the open-source verifier gpa-verify (independent controllers) | data processed by these platforms |
| Public authorities, legal and tax advisers | only where required by law or necessary for legal claims; advisers bound by confidentiality | data necessary for the matter |
4. Changes to this list
4.1 We will publish any intended addition or replacement of a sub-processor on this page at least 30 days before the change and notify business customers by e-mail. Business customers may object under section 6 of the Data Processing Agreement.
4.2 Questions about sub-processors: hello@getproofanchor.com.