Subprocessors
Last updated: 12 September 2026
EINSZWEIDREI SOLUTIONS UG uses the service providers listed below to operate Whazzup. Each of them processes personal data on our behalf under a data processing agreement pursuant to Art. 28 GDPR and only follows our documented instructions.
Current subprocessors
| Provider | Purpose | Data | Place of processing | Transfer safeguard |
|---|---|---|---|---|
| Supabase Supabase Inc., 970 Toa Payoh North, Singapore / EU region hosting | Database, authentication and file storage for the platform | Account data, conversations, contacts, attachments, log data | European Union (Frankfurt region) | Standard contractual clauses for support access from outside the EU |
| Lovable / Cloudflare Lovable Labs Inc. with Cloudflare, Inc. as delivery network | Hosting and delivery of the website, app and widget | IP address, request metadata, content of requests and responses | Global edge network, EU-first routing | Standard contractual clauses |
| Resend Resend, Inc., Delaware, USA | Sending and receiving transactional and support emails | Sender and recipient address, subject, message content, delivery events | USA and European Union | Standard contractual clauses |
| Paddle Paddle.com Market Ltd, London, United Kingdom | Merchant of Record, subscription management, payment processing, tax compliance and invoicing | Name, email address, billing address, tax data, purchased plan, payment and invoice data | United Kingdom and contracted processing locations | UK adequacy decision and standard contractual clauses |
| Google Google Ireland Limited, Dublin, Ireland | Optional Google sign-in and, only after consent, web fonts | Name, email address, profile picture, IP address | Ireland, USA | Standard contractual clauses |
| ipwho.is ipwhois.io (provider of the ipwho.is API) | Approximate location lookup (city, region) from the widget visitor's IP address for support context | IP address only, at the moment of the request; the IP is never stored by us | European Union | Processing within the EU |
Changes to this list
We publish planned changes to this list at least 30 days before a new subprocessor starts processing customer data. Customers may object to a new subprocessor in writing for good cause; if we cannot resolve the objection, either side may terminate the affected services.
The contractual basis is our data processing agreement.