Subprocessors
Effective 2026-10-27
These are the services that process personal data for Zautha. All of them except Polar process the data of the end users of our customers’ applications under our Data Processing Agreement; Polar only handles the billing of workspaces on the Pro plan. zSender is our own email-sending service, operated by us; it is listed so that you can see where email is processed.
| Subprocessor | Purpose | Personal data | Location |
|---|---|---|---|
| Hetzner Online GmbH | Hosts our servers. | All data the service holds, including the backups kept on the server. | Germany (EU) |
| zSender (operated by us) | Our own email-sending service, run by Zautha's operator on Hetzner servers: delivers the emails the service sends (verification codes, sign-in links, invitations and notices). | The recipient's email address and the email's content. | Germany (EU), Hetzner |
| Google (Google Drive) | Stores copies of our nightly backups, in a Google Drive account under Google's standard terms. | Backups of the database, encrypted on our server before they are uploaded: Google cannot read them. | Google's data centres, which may be outside the EU |
| Cloudflare | DNS for our domains, and Turnstile: the check that a sign-up on a live application, or a sign-in after repeated failed attempts, comes from a person and not a bot. | For Turnstile, the IP address and information about the browser and device: the browser sends them to Cloudflare, and our server sends the IP address to confirm the result. | Cloudflare's global network; Cloudflare, Inc. is in the United States |
| Zoho Mail | Receives and stores the email sent to our addresses, such as support@zautha.com and privacy@zautha.com. | What you write to us, and your email address. | Zoho's EU data centre |
| Polar Software, Inc. | Merchant of record for the Pro plan: as the seller and reseller of record, takes the payment, charges any tax, sends receipts and manages the subscription. | A workspace's billing email address, name and id, its subscription, the usage billed for it, and the IP address of the owner who starts a checkout. Card details go to Polar directly and never reach us. Polar receives no data of the end users of applications. | United States |
We use no analytics, advertising or telemetry provider. Our two monitoring services receive no personal data: UptimeRobot requests our public pages and our API’s readiness endpoint, and healthchecks.io receives the status signals of our application, our server and our backup jobs - whether each check passed and, when one failed, a short reason made of fixed text and numbers such as counts and durations.
Before we add or replace a subprocessor of customer personal data, we update this page and tell the owners of every workspace by email at least 30 days in advance, as the Data Processing Agreement sets out.