Sub-processors
Who processes your data when you use EmailConnect: what each company does, where it is and which data reaches it. Last updated 6 October 2026.
Sub-processors for your email data
These two companies process the emails you receive through EmailConnect, on our behalf and under a written contract. They are the sub-processors named in section 5 of our Data Processing Agreement.
| Sub-processor | Location | What it does | Data it handles |
|---|---|---|---|
| Hetzner Online GmbH | Germany (EU) | Application hosting, compute, the PostgreSQL database and the self-hosted mail server (Postfix) | All customer data, in transit and at rest |
| Scaleway SAS | France (EU) | Outbound platform email (sign-in links, subscription notices). Optional managed S3 storage for large attachments | Your account email address, for platform email. Large inbound attachments at rest, when you use our managed storage. Email bodies and metadata stay at Hetzner |
Inbound email is received on our own mail server, processed in our own application and delivered to your webhook from there. No other company sits in that path.
Services you deal with directly
These act as independent controllers, not as our sub-processors. We do not hand them your personal data; where data is involved, you provide it to them yourself.
| Service | Location | What it does | Data involved |
|---|---|---|---|
| Mollie B.V. | Netherlands (EU) | Payment processing | We send an anonymous reference and an amount. You give your payment details to Mollie directly |
| Plausible Insights OÜ | Estonia (EU) | Website and dashboard analytics | Anonymised, cookieless usage data. No personal data |
| GitHub Inc. (Microsoft) | USA | Optional sign-in with GitHub | Only if you choose GitHub sign-in: you authenticate with GitHub directly |
| Google LLC | USA | Optional sign-in with Google | Only if you choose Google sign-in: you authenticate with Google directly |
Sign-in with GitHub or Google is optional. Choosing it transfers your login to a US company, under the EU-US Data Privacy Framework with Standard Contractual Clauses as a fallback. Signing in with email involves neither.
Services we use to run the business
None of these receives the emails you process.
| Service | Location | What it does | Data involved |
|---|---|---|---|
| Moneybird B.V. | Netherlands (EU) | Our bookkeeping | Invoice data for paying customers: billing name, address, VAT number, amounts |
| Scaleway SAS (Generative APIs) | France (EU) | The language model and the documentation search behind the in-app help assistant | The questions you type into the help assistant. Never your emails |
Error tracking, uptime monitoring and our status page run on software we host ourselves.
Changes to this list
We tell customers about an intended change to our sub-processors at least 30 days in advance, so you can object. If you object on reasonable data-protection grounds, you may terminate the affected service. This is the commitment in section 5 of the Data Processing Agreement, and this page carries the date of its last change at the top.
Related
- Data Processing Agreement: the full text
- About the DPA: what it covers and how to download your copy
- Data retention: how long email data is kept on each plan
- EU compliance
- Security and responsible disclosure
- Service status