Subprocessors

Last updated: 15 October 2026

Captomatic uses the following providers for the hosted Falcon service. They are subprocessors under the Data Processing Agreement to the extent they process Customer Data on Captomatic's behalf. Processing of Captomatic's own account and billing data is covered by the Privacy Policy. This list does not describe providers an on-premises operator engages itself.

Provider	Purpose	Data	Processing locations and transfer terms
Hetzner Online GmbH	Server hosting, database, processing workers, monitoring and error reporting	Service data hosted or processed on those servers, including media, site and device records, activity and purchase records, account details and logs	Helsinki, Finland
Cloudflare, Inc.	Reverse proxy, DNS and DDoS protection	Proxied request and response content, IP addresses and request/security logs	Global network, including outside the EEA; Cloudflare DPA includes Standard Contractual Clauses for restricted transfers
Cloudflare, Inc. (R2)	Storage of uploaded and processed media and site assets	Photos, videos, face detection data, overlays, other uploaded assets and request metadata	Cloudflare network; no EU-only residency commitment. Cloudflare DPA
Stripe Payments Europe, Limited and relevant Stripe affiliates	Service billing, connected-account onboarding and checkout for paid media	Billing contacts, payment and identity details entered on Stripe's pages, purchase amounts and identifiers of the media set, delivery configuration and categories purchased	Ireland, the US and other countries used by Stripe; Stripe DPA and transfer terms
Mailgun Technologies, Inc.	Transactional account and site email	Recipient email address, message content and delivery metadata	EU sending region, with international processing under the Sinch DPA, including Standard Contractual Clauses for restricted transfers

Stripe also acts as an independent controller for purposes such as legal compliance and fraud prevention, as described in its DPA. Providers engaged directly by the Customer, including its own storage or payment account provider, are governed by the Customer's arrangements with them for that processing.

Captomatic updates this page when the list changes and gives notice of subprocessor additions or replacements under section 6 of the DPA.