Sub-processors

Provider: Hostinger International Ltd, 61 Lordou Vironos Street, 6023 Larnaca, Cyprus.

Role: rental of the virtual private server (VPS) that runs the application, the API and the database. Deployment is handled by Coolify, software installed on that same server, which is not a separate provider.

Data concerned: all data of the Service, including account data, the audit events you send us, the billing data kept by Recalled, and technical logs.

Location: a Hostinger data center. The exact region of the server is being verified; this page will be updated as soon as it is confirmed.

Transfer outside the EEA: none planned by the Publisher.

Provider: PostHog Inc. (United States), EU Cloud offering.

Role: website audience measurement and product usage analytics, and session recording on public pages if you consent (see the Privacy Policy, section 8).

Data concerned: page views and product events, internal identifier, email address and name when you are signed in and have accepted analytics cookies, IP address and user agent. The audit events you send to Recalled are never sent to PostHog.

Location: European Union (EU Cloud, Frankfurt, Germany).

Transfer outside the EEA: PostHog Inc. being a US company, access from the United States remains possible; it is covered by the European Commission's Standard Contractual Clauses provided in PostHog's standard data processing agreement.

Provider: Resend, Inc. (United States).

Role: sending transactional emails (sign-in links, account verification, password reset, sign-in codes, quota and billing notices).

Data concerned: your email address, your name and the content of the email. Your audit events are never sent to Resend.

Location: Resend's European Union region (Ireland).

Transfer outside the EEA: access from the United States remains possible; it is covered by the Standard Contractual Clauses included in Resend's standard data processing agreement.

Provider: Google Ireland Limited (Ireland), a subsidiary of Google LLC (United States).

Role: hosting of the contact@recalled.dev mailbox, which receives your questions, your GDPR requests and replies to the Service's emails.

Data concerned: the content of the emails you send us, your email address and name, and attachments.

Location: Google's global infrastructure; data may be processed outside the EEA.

Transfer outside the EEA: covered by the EU–US Data Privacy Framework, under which Google LLC is certified, and by the Standard Contractual Clauses of the Google Workspace data processing terms.

Provider: Stripe Payments Europe, Limited (Ireland), together with Stripe, Inc. (United States).

Role: collecting subscription payments, invoices, billing portal. For some of its own obligations (fraud prevention, financial regulation), Stripe acts as an independent controller.

Data concerned: name, email address, billing address, VAT number where applicable, payment history. Card details are entered at Stripe and never pass through Recalled.

Location: European Union and United States.

Transfer outside the EEA: covered by the EU–US Data Privacy Framework, under which Stripe, Inc. is certified, and by the Standard Contractual Clauses of Stripe's standard data processing agreement.

Provider: OpenStatus (openstatus.dev).

Role: public status page (recalled.openstatus.dev) and probes that regularly call Recalled's public endpoints to measure availability.

Data concerned: none of your account data or events. When you visit the status page, OpenStatus processes the technical data of your visit (IP address, user agent).

Location and transfer outside the EEA: depends on OpenStatus's infrastructure, being verified; this page will be completed.

Sign in with Google: if you choose to sign in with your Google account, Google (Google Ireland Limited) authenticates your account and sends us your email address and name. Google then acts as an independent controller for your Google account; it is not a sub-processor of the Publisher.

Destinations you configure: notification channels (Discord, Telegram) and the webhooks or tools you forward your events to (a SIEM, for example) receive the data you send them, at your request. They are your own providers, not sub-processors of the Publisher.

Website fonts: they are bundled into the site when it is built; your browser does not contact any third-party service to load them.

Before adding or replacing a sub-processor that processes customer data, the Publisher updates this page and notifies active customers by email at least 30 days in advance. During that period, you can object by writing to contact@recalled.dev.

For any question about this list, write to contact@recalled.dev.