Legal · GDPR Art. 28
Subprocessors
Version: 2026-10-24
English version for people living in Germany, Austria or Switzerland who prefer to read in English. All language versions of this document have the same content; the German text is the source text.
List of all processors under Art. 28 GDPR that WhispaWave uses. Binding source for the Privacy Policy, hosting transparency (in German) and Annex 2 to the data processing agreement (AVV) (in German) — all three pages are generated from the same data. If a service that can process dictations, conversations or notes is added or replaced, we announce this to existing customers by email at least 30 days before it takes effect; services that only concern the website are entered here with a date.
| Provider (legal entity) | Purpose | Registered office / data location | Status | Legal basis |
|---|---|---|---|---|
| Mistral AI Mistral AI SAS (R.C.S. Paris 952 418 325) | AI processing: speech recognition (cloud cases), text improvement, translation, conversation transcription, meeting notes and documents from conversations, meeting chat, template drafts, text recognition (OCR) and filling of forms | Registered office: France (Paris) Data: EU regional endpoint (api.eu.mistral.ai); inference in EEA data centers (France, Sweden/Norway, EEA inference partners according to the provider's chain) | Active | Data processing agreement under Art. 28 GDPR + Zero Data Retention (confirmed 2026-08-20), EU regional endpoint |
| Supabase Supabase Inc. | Database, sign-in, server functions, file storage; counters of the overload protection of the website forms (pseudonymized check values only) | Registered office: USA Data: EU region Frankfurt am Main (eu-central-1) on the data center infrastructure of Amazon Web Services (second-tier subprocessor; infrastructure only — no AI processing on AWS) | Active | Data processing agreement under Art. 28 + EU standard contractual clauses, EU data region |
| Hetzner Online Hetzner Online GmbH | Our own AI relay server; our own, self-operated error reporting system (crash reports only with consent, content-free server error events); email images; app update origin | Registered office: Germany Data: Falkenstein / Nuremberg, DE (the provider's own data centers, no hyperscaler sub-chain) | Active | Data processing agreement under Art. 28 GDPR, registered office in Germany |
| IONOS IONOS SE | EU fallback service for text improvement (only if the primary service fails) | Registered office: Germany Data: German data centers (IONOS Cloud) | Active (EU fallback service) | Data processing agreement under Art. 28 GDPR, registered office in Germany |
| Scaleway Scaleway SAS | Speech recognition for dictation: first service for languages the primary service does not recognize; otherwise EU fallback service (only if the primary service fails) | Registered office: France Data: Paris, FR | Active | Data processing agreement under Art. 28 GDPR, registered office in the EU |
| Resend Plus Five Five, Inc. (Resend) | Transactional emails, support replies, website forms (contact, job application, cancellation confirmation), newsletter contact list | Registered office: USA Data: USA — according to the provider, account data, email metadata and logs are stored in the USA; the sending infrastructure can be chosen per domain (including Ireland), but only controls the sending route | Active | Data processing agreement under Art. 28 + EU standard contractual clauses; provider certified under the EU-US Data Privacy Framework (provider's statement); processing in the USA |
| Stripe Stripe Payments Europe Ltd. | Payment processing (subscriptions, referral coupons) | Registered office: Ireland Data: Dublin, IE (EU); the provider's US group chain for payment processing | Active | Data processing agreement under Art. 28 GDPR, registered office in the EU |
| Plausible Analytics Plausible Insights OÜ | Audience measurement of the website (cookieless, without storing IP addresses; aggregated statistics only) | Registered office: Estonia (Tartu) Data: Servers in Germany (Falkenstein); data does not leave the EU | Active (website only) | Data processing agreement under Art. 28 GDPR, registered office in the EU |
| Vercel Vercel Inc. | Hosting of the website (incl. server-side processing of the forms) | Registered office: USA (Delaware) Data: Server functions Frankfurt (fra1); worldwide edge delivery of static content | Active (website only) | Data processing agreement under Art. 28 + EU standard contractual clauses |
| BunnyWay (bunny.net) BunnyWay d.o.o. | Delivery of app updates (CDN) | Registered office: Slovenia Data: EU delivery nodes | Active | Data processing agreement under Art. 28 GDPR, registered office in the EU |
| Linkup Linkup Technologies SAS | Web search in the Meetings chat (switched on by default, can be switched off; search terms only) | Registered office: France (Fresnes) Data: EU, USA, Canada, Asia-Pacific region — according to the provider, any search query can be processed in any of these regions depending on load | Active | Data processing agreement under Art. 28 GDPR, registered office in the EU; processing also possible outside the EU, safeguard under Art. 46 GDPR not yet evidenced |
- Mistral AI: Zero Data Retention is active for our account (written confirmation from the provider dated 2026-08-20): inputs and outputs are not stored after processing and are not used for training. The models run via the EU regional endpoint; among them are GLM models with open weights from Z.ai, operated by Mistral AI on EU infrastructure — Z.ai receives no data.
- Resend: Resend stores account data, email metadata and logs in the USA — regardless of the sending region chosen. We do not send dictations or conversations by email; only diagnostic attachments that you yourself add to a support ticket can contain short excerpts.
- Plausible Analytics: Cookieless audience measurement without storing IP addresses; the script and the measurement data run via whispawave.de. The data processing agreement is part of Plausible's terms of use.
- BunnyWay (bunny.net): Only IP addresses flow when app updates are fetched, no app content. bunny.net's data processing agreement is part of the customer account.
- Linkup: Since version 1.1.0 of the Mac app, the web search in the Meetings chat is switched on by default; you switch it off in the settings under “Meetings”. Linkup only receives the search term that the assistant formulates for your question. A data processing agreement has been in place with Linkup since 2026-10-24; however, Linkup can also process search queries outside the EU. We have requested the commitment not to store search queries (Zero Data Retention) and processing in the EU only; neither is in place yet (Privacy Policy, section 6).
EU fallback services. If our primary AI service provider is temporarily unavailable, EU fallback services step in automatically: IONOS SE (Germany) for text improvement and Scaleway SAS (France) for speech recognition — not for Conversation mode. Dictations in the languages that our primary AI service provider does not recognize are also recognized by Scaleway as the first service. They, too, process your content only to carry out your request; according to their published privacy terms, they exclude training with your content and its permanent storage.
Sign-in services. If you sign in with Apple, Google or Microsoft, the respective provider processes your sign-in data; this only happens if you choose this sign-in method yourself.
Third-country transfers
The content of your dictations and conversations is processed and stored in data centers in the EU; the dictation path (speech recognition, AI relay server, database) runs via EU data locations. One exception is the web search in the Meetings chat: Linkup (registered office in France; data processing agreement since 24 October 2026) can also process the search terms that the assistant formulates for your question in the USA, in Canada and in the Asia-Pacific region. We have requested processing in the EU only and the commitment not to store search queries; neither is in place yet (Privacy Policy, section 6). You can switch off the web search in the settings. Some of our service providers belong to US groups of companies (e.g. Supabase Inc., Vercel Inc.) — we integrate them via EU data regions and EU standard contractual clauses and disclose this per service in the table above. Access by authorities under US law cannot be legally ruled out completely in these cases; that is why we name it transparently instead of explaining it away.
Change procedure
If we change or add a processor that can process your content, we inform existing customers by email at least 30 days before the change takes effect and enter the change here with a date. During this period, you have a right to object (objection to privacy@whispawave.de, response within 14 calendar days). Without an objection, the new subprocessors are deemed accepted. If a service has to be replaced immediately for compelling security or availability reasons, we provide this information afterwards, within 10 days at the latest. Services that only concern the website and do not touch any app content are documented only here, with a date.
Version history of this list: via the Git log in the internal repository. If you have questions: privacy@whispawave.de.