Sub-processors
Interim versionInterim list from our vendor register. The binding list will be published here and forms an annex to the data processing agreement.
These service providers process personal data on behalf of SelbstFinanz. Where processing takes place outside the EU, the basis of the transfer is stated.
| Provider | Purpose | Data categories | Place of processing | Transfer basis |
|---|---|---|---|---|
| SupabaseSupabase, Inc. (USA) | Database, sign-in (including two-factor authentication) and file storage; sending sign-in emails (invitations, password resets) while the app's own sending for them is not active | Account data (email address, sign-in and role data); business master data (name, address, VAT ID, bank details); bookkeeping data (invoices, payments, expenses, trips, mileage, VAT figures); data of the business's clients (name, address, email address, VAT ID); receipts and documents (photos, PDFs, mileage logs, email attachments); addresses and places (trip destinations); email content and recipient addresses; credentials (mailbox passwords encrypted, API keys of own email providers); device identifiers (push token, Firebase installation ID); technical data (IP address, browser and device signals) | EU – Frankfurt am Main (AWS eu-central-1); downloaded files are cached for up to 1 hour at Cloudflare CDN nodes near the person downloading them; company based in the USA | EU-U.S. Data Privacy Framework (Art. 45 GDPR), otherwise Standard Contractual Clauses (Art. 46(2)(c) GDPR) |
| VercelVercel Inc. (USA) | Running the web app and the website: server functions, scheduled jobs, delivery and request logs | Account data (email address, sign-in and role data); business master data (name, address, VAT ID, bank details); bookkeeping data (invoices, payments, expenses, trips, mileage, VAT figures); data of the business's clients (name, address, email address, VAT ID); receipts and documents (photos, PDFs, mileage logs, email attachments); addresses and places (trip destinations); email content and recipient addresses; technical data (IP address, browser and device signals); log data (requests, server logs) | Server functions in Frankfurt am Main (fra1); requests pass through Vercel's global edge network (encryption, routing, static files); company based in the USA | EU-U.S. Data Privacy Framework (Art. 45 GDPR), otherwise Standard Contractual Clauses (Art. 46(2)(c) GDPR) |
| Anthropic (Claude)Anthropic PBC (USA) | AI reading of receipts, invoices, imported sales invoices, mileage logs and mailbox attachments; answers of the “Ask your books” feature | Receipts and documents (photos, PDFs, mileage logs, email attachments); bookkeeping data (invoices, payments, expenses, trips, mileage, VAT figures); data of the business's clients (name, address, email address, VAT ID); addresses and places (trip destinations); questions to “Ask your books” and the figures computed for them (incl. client names and balances) | USA | EU-U.S. Data Privacy Framework (Art. 45 GDPR), otherwise Standard Contractual Clauses (Art. 46(2)(c) GDPR) |
| Twilio SendGridTwilio Inc. (USA) | Email delivery: invoices, payment reminders and recurring invoices businesses send through SelbstFinanz (with the PDF), invitations and account, billing and system notices; delivery events (delivered, bounced, spam report) | Email content and recipient addresses; data of the business's clients (name, address, email address, VAT ID); bookkeeping data (invoices, payments, expenses, trips, mileage, VAT figures); receipts and documents (photos, PDFs, mileage logs, email attachments); account data (email address, sign-in and role data) | USA (global endpoint api.sendgrid.com) | EU-U.S. Data Privacy Framework (Art. 45 GDPR), otherwise Standard Contractual Clauses (Art. 46(2)(c) GDPR) |
| Google Maps PlatformGoogle Ireland Limited (Ireland) | Address suggestions and driving distances for the mileage log (Kilometergeld); queried by our server, without the user's IP address | Addresses and places (trip destinations) | Google's global infrastructure (no region can be chosen) | EU-U.S. Data Privacy Framework (Art. 45 GDPR), otherwise Standard Contractual Clauses (Art. 46(2)(c) GDPR) |
| Google Firebase Cloud MessagingGoogle Ireland Limited (Ireland) | Push notifications to the iOS app (e.g. when an invoice is fully paid), once notifications are allowed on the device; the notification text names the business and the invoice number | Device identifiers (push token, Firebase installation ID); notification content (business name, invoice number); technical data (IP address, browser and device signals) | Google's global infrastructure | EU-U.S. Data Privacy Framework (Art. 45 GDPR), otherwise Standard Contractual Clauses (Art. 46(2)(c) GDPR) |
| Apple Push Notification serviceApple Inc. (USA) | Delivering those push notifications to iPhones (Firebase hands them to Apple) | Device identifiers (push token, Firebase installation ID); notification content (business name, invoice number) | Apple's global infrastructure | EU-U.S. Data Privacy Framework (Art. 45 GDPR), otherwise Standard Contractual Clauses (Art. 46(2)(c) GDPR) |
This translation is for information only; the German version prevails. German version