Provider and Role Schedule
Current complete version. The German version controls where stated in the document.
Version: 1.6
This English version is provided for convenience. The German version controls.
Change notice: at least 30 days before a new or replacement direct subprocessor.
1. Direct subprocessors for Customer Data
| Provider | Role and service | Location / transfer | Current evidence |
|---|---|---|---|
| Hetzner Online GmbH | Subprocessor for Relay handling of transient audio, text, image, document content, and required routing data | Nuremberg, Germany; further providers per vendor documents | https://www.hetzner.com/AV/DPA_de.pdf · https://www.hetzner.com/de/AV/TOM.pdf · https://www.hetzner.com/AV/subunternehmer.pdf |
| Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland | Vertex AI for transient audio, text, image and document processing; zero data retention for project 674711097607 (approved logging exception, data cache disabled) | Vertex AI: Google Cloud EU multi-region for spoken translation, the language request, text, captions, images and documents; transfer under Cloud DPA and applicable mechanism | https://cloud.google.com/terms/data-processing-addendum · https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/abuse-monitoring · https://docs.cloud.google.com/gemini-enterprise-agent-platform/resources/zero-data-retention |
| Supabase, Inc. | Subprocessor only for Customer Data Supabase actually receives, including short-lived Edge/session data | Central EU (Frankfurt) primary region; further processing under DPA/TIA | https://supabase.com/legal/customer-resources/data-processing-addendum · https://supabase.com/downloads/docs/Supabase+TIA+250314.pdf |
Doli flows down required obligations and remains fully liable for performance of these subprocessors' obligations.
2. Providers for Doli independent-controller data
- Google is an independent controller for separate Cloud Service Data, such as account, payment, configuration, technical usage and communication data, under the Google Cloud Privacy Notice: https://cloud.google.com/terms/cloud-privacy-notice. That notice covers Service Data, not Customer Data processed under the Cloud DPA.
- Supabase is Doli's processor for account, contract, purchase, artifact, and security records.
- RevenueCat, Inc. is Doli's processor for Store purchase, entitlement, and reconciliation—not a content subprocessor. When purchase services are used, its SDK may process technical customer information, product identifiers, offerings, and purchase processing before business-contract activation. Its DPA and subprocessor list are at https://www.revenuecat.com/dpa.
- STRATO AG is Doli's processor for personalized-contract email from info@doliapp.de—not a content subprocessor.
- Netlify, Inc. is Doli's processor only for public website hosting; no Netlify forms are used, and Netlify receives no personalized contract PDFs. Evidence: https://www.netlify.com/pdf/netlify-dpa.pdf and https://www.netlify.com/legal/subprocessors/.
3. Independent-controller Stores and changes
Apple App Store and Google Play are generally independent controllers for Store account, payment, renewal, cancellation, and refunds under their own terms. Doli reviews provider lists based on risk, gives DPA notice, and handles documented objections under DPA Section 8.