# Subprocessors

> The service providers that process personal data for Roasby, what they do and where.

We use the service providers below to run Roasby. Each one processes personal data only on our instructions and under a contract with data protection terms. This list is part of our [Privacy Policy](/privacy) and [Data Processing Addendum](/dpa).

## Infrastructure and operations

| Provider | Purpose | Data | Location |
| --- | --- | --- | --- |
| Hetzner Online GmbH | Server hosting: application, database, file storage | All Service data | Germany, Finland |
| Cloudflare, Inc. | Network proxy, DNS and attack protection; transactional email delivery; encrypted database backups (R2) | Traffic data; email recipients, subjects and content; encrypted backups | United States, EU and global network |
| Functional Software, Inc. (Sentry) | Error monitoring | Error reports: technical details and URLs, without names or email addresses | United States |
| Stripe, Inc. | Payments, subscriptions, invoices and tax | Billing contact, address, tax ID, payment details (handled by Stripe) | United States |

## In-app AI

| Provider | Purpose | Data | Location |
| --- | --- | --- | --- |
| OpenAI, L.L.C. | In-app AI features: recommendations, triage (including support and sign-up triage), summaries (business API; no training, retention up to 30 days) | Only the ad data and text a feature needs | United States |
| Anthropic, PBC | Fallback for the same in-app AI features (business API; no training, retention up to 30 days) | Only the ad data and text a feature needs | United States |

## Analytics and advertising (only with your consent)

These tools are set up to run only on our public pages (home page, product, FAQ and guide pages, docs, legal and sign-in pages), only for visitors who are signed out, not inside the signed-in app, and only after you accept them in the cookie notice.

| Provider | Purpose | Data | Location |
| --- | --- | --- | --- |
| Google LLC (Google Analytics 4, Google Ads tag) | Website analytics; measuring our own ads | Pseudonymous identifiers, pages viewed, device and approximate location | United States |
| Microsoft Corporation (Clarity, Advertising UET) | Website analytics and session replay with masked inputs; measuring our own ads | Pseudonymous identifiers, interactions, device and approximate location | United States |
| Meta Platforms, Inc. (Meta Pixel) | Measuring our own ads | Pseudonymous identifiers, pages viewed, device | United States |
| LinkedIn Corporation (Insight Tag) | Measuring our own ads | Pseudonymous identifiers, pages viewed, device | United States |

## Not subprocessors: services you connect

Some services receive data because **you** connect them and ask Roasby to work with them. They act under their own terms with you, not as our subprocessors:

- **Ad platforms:** Google Ads (Google LLC), Microsoft Advertising (Microsoft Corporation), ChatGPT Ads (OpenAI). Google sign-in also falls here.
- **AI assistants and MCP clients:** for example Claude (Anthropic), ChatGPT and Codex (OpenAI), Cursor (Anysphere). They receive the results of the Roasby tools they call.

## Changes

We update this page before a new subprocessor starts processing customer personal data. Customers under the DPA can subscribe to changes by emailing **privacy@roasby.com**, and may object within 30 days as described in the DPA.