Subprocessors
Last updated: 13 November 2026
This is a translation for convenience. Only the German version is legally binding.
These providers process personal data on our behalf (Art. 28 GDPR). This list is Annex 3 of the data processing agreement. We update it before a new subprocessor goes into production.
In use
| Provider | Purpose | Seat / processing | Data | Basis |
|---|---|---|---|---|
| Hetzner Online GmbH | Hosting, file storage, access logs | Germany (Falkenstein, Nuremberg) | all data stored in Stitchomat | DPA · processing in Germany |
| OpenRouter, Inc. | Access to the AI models (routing of requests) | USA | end customers’ wish text, the image description derived from it, generated image drafts | OpenRouter Data Processing Agreement with EU standard contractual clauses (part of its terms of service) · no training by OpenRouter |
| Google LLC (Gemini image model, via Google AI Studio or Vertex AI) | Generating image drafts | USA / worldwide | image description without names from the name field | sub-processor of OpenRouter |
| Anthropic language model Claude, operated depending on routing by Anthropic, PBC, Amazon Web Services, Google (Vertex AI) or Microsoft (Azure) | Splitting the wish text into image description and text to embroider, check for inadmissible content | USA / worldwide | end customers’ wish text | sub-processor of OpenRouter |
Planned
Not yet in use: no processing takes place through these providers at the moment. We only move them to “In use” after prior notice.
| Provider | Purpose | Seat / processing | Data |
|---|---|---|---|
| Stripe Payments Europe, Ltd. | Billing of plans | Ireland; transfers to Stripe, Inc. (USA) based on EU standard contractual clauses | only the businesses’ billing and payment data, no end-customer data |
| Transactional email provider (not yet chosen, EU intended) | Login links, notifications | open | email addresses, notification content |
Not in this list
Error monitoring is self-hosted – no telemetry goes to an external service. We obtain TLS certificates from Let’s Encrypt; no personal data of customers or end customers is transmitted for this. All other components run on our own infrastructure at Hetzner.
Changes
We announce the use of a new subprocessor at least 30 days in advance by email to the businesses’ administrators – with provider, purpose, location and date. You may object to the change within this period. Questions: datenschutz@golle-it.de.