This is a convenience translation. The legally binding version is the German original at /subprocessors. In case of any discrepancy, the German version prevails.
Sub-processors and recipients
Last updated: 15 September 2026 · Version 1.0
On this page we list in full which service providers may process personal data in the course of providing JobSteward. We keep the list up to date and announce changes in accordance with section 4.
You will find additional information in our Privacy policy.
1. Processors (Art. 28 DSGVO (GDPR))
We have a data processing agreement in place with every service provider named here. They process data exclusively on our instructions.
| Service provider | Registered office | Task | Place of processing | Basis where a third country is involved |
|---|---|---|---|---|
| Clerk, Inc. 660 4th St #312, San Francisco, CA 94107, USA | USA | Registration, sign-in, password management, sessions, authorisation of the AI connection | USA | EU-U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795), supplemented by Standard Contractual Clauses Module 2 |
| Railway Corporation San Francisco, USA | USA | Operation of the application and the database | European Union (EU region) | Standard Contractual Clauses; the workloads and the database are in the EU region |
| Hostinger International Ltd Limassol, Zypern (transitional only) | EU | Operation of the application until the migration to Railway is complete | European Union | none – processing in the EU |
| Cloudflare, Inc. 101 Townsend St, San Francisco, CA 94107, USA | USA | Domain management, delivery of the website, protection against automated access, object storage for uploaded files (R2), forwarding of support emails | European Union (R2 storage region restricted to the EU); delivery via the global network | EU-U.S. Data Privacy Framework, supplemented by Standard Contractual Clauses |
| Functional Software, Inc. (Sentry) 45 Fremont Street, San Francisco, CA 94105, USA | USA | Monitoring of technical errors | European Union (Germany region, de.sentry.io) – the data does not leave the EU | Standard Contractual Clauses; no third-country transfer in normal operation |
Umami (usage measurement) we run ourselves on our own server in the European Union. It is not a service provider; no transfer to third parties takes place.
Note on the migration under way: operation is currently being migrated from Hostinger to Railway. Until the migration is complete, both providers are listed; the Hostinger entry will be removed thereafter. In both cases the processing takes place in the European Union.
2. Independent controllers
These companies process data in their own name and under their own privacy terms. They are not our processors.
| Recipient | Registered office | When data flows | Privacy information |
|---|---|---|---|
| Paddle.com Market Limited 30 Old Bailey, London EC4M 7AU, Vereinigtes Königreich (reg. no. 8172165) — our reseller and merchant of record; your contractual partner for the purchase | United Kingdom | when a paid subscription is taken out, billed, renewed or refunded | https://www.paddle.com/legal/privacy |
| Google Ireland Limited Gordon House, Barrow Street, Dublin 4, Irland | Ireland | only if you choose to sign in with Google | https://policies.google.com/privacy |
| Anthropic Ireland, Limited 6th Floor, South Bank House, Barrow Street, Dublin 4, Irland | Ireland | only if you connect Claude as an AI assistant – and only to the extent of the permissions you have granted | https://www.anthropic.com/legal/privacy |
| OpenAI Ireland Limited 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, Irland | Ireland | only if you connect ChatGPT as an AI assistant – and only to the extent of the permissions you have granted | https://openai.com/policies/eu-privacy-policy/ |
| Provider of another AI assistant connected by you | depends on the provider | only at your instigation | the respective provider's own information |
The AI connection is switched off by default. Without your express action, no data flows to any provider of AI assistants.
Paddle in particular. Paddle is our reseller, not our processor. There is therefore no data processing agreement with Paddle under Art. 28 DSGVO, but rather an agreement on the transfer of data between two independent controllers (Paddle Data Sharing Addendum). The transfer to the United Kingdom is based on the European Commission's adequacy decision of 19 December 2025 (Art. 45 DSGVO). Paddle publishes neither a list of its own sub-processors nor specific storage locations; we are therefore unable to provide details on this.
3. What we do not use
For the avoidance of doubt: we use no advertising networks, no tracking or marketing pixels, no social media plugins, no embedded third-party videos or maps, no external font services and no third-party customer service chat windows. We serve external fonts and scripts exclusively from our own server.
4. Changes to this list
We inform registered users by email at least 30 days in advance before we engage a new processor or replace an existing one. If you object to the change, you may terminate the contract extraordinarily up to the point at which the change takes effect.
Questions about this list, including requests for a copy of the agreed safeguards for third-country transfers: support@job-steward.com