Subprocessors
Version 1.0. Effective [EFFECTIVE_DATE].
This is the public list of companies that handle your data for plintus. A “subprocessor” is a company we hire to process personal data on our orders. [COMPANY_NAME] is the controller, or the processor for Studio customers (dpa.md).
How to read the “In use” column:
- Launch means we use it when plintus opens to the public.
- Backup means we have it set up behind the same interface and use it only if the first choice fails, or for customers who ask. We update this list before we send real user data to it.
- Later means we plan it for higher volume. We update this list first.
1. Companies that handle user data
| # | Company | Entity and country | Task | Data it gets | Where it processes | In use |
|---|---|---|---|---|---|---|
| 1 | Hetzner Online GmbH | Germany | Servers (API, database, realtime, workers, our own mail server, analytics, logs, search) and object storage for photos, videos, rooms and exports | Everything you store in plintus | Germany and Finland (Hetzner locations Falkenstein or Nuremberg, and Helsinki) | Launch |
| 2 | Stripe Payments Europe, Ltd., and Stripe, Inc. | Ireland, and the US | Payments, subscriptions, invoices, VAT (Stripe Tax), customer portal | Name, email, billing address, VAT ID, payment method, what you bought | EU, with access from the US | Launch |
| 3 | Auth0, an Okta company | US parent. EU tenant | Sign-in and account identity (Google, Apple, X, email and password) | Name, email, sign-in method, hashed password if you use email sign-in, sign-in logs | EU tenant | Launch |
| 4 | Anthropic, PBC | US | The assistant: answers and design proposals | Scene data (items, sizes, catalog facts), small pictures of your room (at most 1568 px, hidden data removed). Never your raw uploads, name or email | US or worldwide (“inference geography” global or us). Not EU-only | Launch |
| 5 | Black Forest Labs GmbH | Germany | Idea pictures: restyles your photo in three styles | The photo you submit, a style prompt, and a depth or edge guide made from your photo | EU endpoint (api.eu.bfl.ai) | Launch |
| 6 | RunPod, Inc. | US parent. EU data centres | GPU processing for room scans, 3D models from photos and pictures | Photos or video for the time of a job. The worker deletes its copies at the end of the job | EU data centres only | Launch |
| 7 | Functional Software, Inc. (Sentry) | US parent. EU region | Error and speed reports from the app and servers | Error text, page address, user id, browser and graphics card name. Emails and images are scrubbed | EU region | Launch |
| 8 | Bunny Communications d.o.o. (bunny.net) | Slovenia | Fast delivery of public files (app files, catalog models and textures) | Your IP address, when you load a public file. No user content | Global edge network, with EU origin | Launch |
2. Backup and later
| # | Company | Entity and country | Task | Data it gets | Where it processes | In use |
|---|---|---|---|---|---|---|
| 9 | fal.ai (Features and Labels, Inc.) | US | Second image service for idea pictures and pictures, if the first one fails | As row 5 | Not yet checked. We use it only after we confirm an EU route and “no training” in writing | Backup |
| 10 | Google Cloud (Vertex AI) | Ireland, US parent | Second route for the assistant, in the EU region, for customers who need EU-only processing | As row 4 | EU region | Backup |
| 11 | Google (Gemini image edit, EU region) | Ireland, US parent | A third image service, if the first two fail | As row 5 | EU region | Backup |
| 12 | Modal Labs, Inc. | US | Second GPU provider, in an EU region | As row 6 | EU region | Backup |
| 13 | A vast.ai production pool | US. Rented machines in EU data centres | More GPU capacity when volume grows. Only “secure cloud” machines in EU data centres. Never community hosts | As row 6 | EU data centres | Later |
3. Run by us
These run on our own servers at Hetzner. No other company gets this data. Hetzner (row 1) is the only company that hosts them.
| Tool | Task |
|---|---|
| mailcow | Our mail server for product mail and team mailboxes |
| Umami | Cookie-free statistics. No personal data |
| Meilisearch | Product search. Holds catalog data, not user data |
| Prometheus, Loki, Grafana | Metrics, logs (30 days) and dashboards |
| Postgres | The database |
4. Companies that are not our processors
These get data under their own terms, as separate controllers.
| Company | When | What |
|---|---|---|
| Google, Apple, X | When you choose to sign in with them | Your sign-in. They tell us your name and email |
| Stores (IKEA, Home24 and others) | When you press a buy link | Your visit to their site, under their policy. We send them no personal data |
| Affiliate networks (Awin, Adtraction, Tradedoubler, Daisycon, Webgains, impact.com, or the store’s own program) | When you press a buy link | Your click on their link, under their policy. They set their own cookies on their own sites |
5. Tools that touch no user data
Listed so you can see the whole picture. GitHub (code and builds), GitHub Container Registry (software images), Tailscale (our staff network), OpenTofu and Kamal (our deploy tools). Our staff use them to run plintus. They do not receive your content or account data.
6. How we choose and watch a subprocessor
Before a vendor gets user photos or data, we check:
- It has signed a data processing agreement with us.
- Its terms say it does not use our data to train models (Q49 in the quality bar).
- We know where it processes data, and it is in the EU, or covered by the EU standard contractual clauses or the EU-US Data Privacy Framework.
- It keeps data only as long as it needs to run our request.
We keep each vendor’s terms and the date we checked them on file.
7. Changes to this list
We tell Studio customers by email at least 30 days before a new subprocessor gets customer content. They can object (dpa.md section 7). We tell everyone else on this page. The date at the top changes each time. A short change log sits below.
| Date | Change |
|---|---|
| [EFFECTIVE_DATE] | First version |