Subprocessors and processing locations

1. Providers processing customer data

• Supabase — database, authentication and real-time features. May process identity, workspaces, customers, messages and audit data. The primary region depends on the project. The contracting entity, support access and further providers must be confirmed against the customer’s agreement.
• Railway — hosting the web application, API, background jobs and Redis. Processes content during execution, queue data and technical operational information. The region of each service, logs, copies and contracting entity must be confirmed.
• Cloudflare — network protection, DNS, Turnstile and R2 attachment storage. Processes network metadata and attachments depending on the enabled feature. R2 jurisdiction, edge processing, support access and contracting entity must be confirmed. The SDK value auto does not document a specific jurisdiction.
• Mailgun / Sinch — email receipt and sending, message processing and delivery events. May process sender, recipients, subject, content, attachments and delivery metadata. A European API is specified as the intended operational configuration. The active region, contracting entity and provider’s own retention periods must be confirmed. The provider’s terms may involve independent controller responsibilities for limited communications, network security and abuse prevention purposes. The role and legal basis must be clarified for each processing operation.

2. Conditional processing and other roles

• OpenAI — possible AI provider for enabled features. Only documented, lawfully instructed content may be transferred. Active use, contracting entity, region, retention, transfer basis and settings for the provider’s data use must be confirmed before transfer.
• Stripe — payments, subscriptions and invoices. Processes payment, contact and billing data. Its role may be processor or independent controller depending on the purpose. Card details are processed in Stripe fields. The relevant contracting entity and transfer arrangements follow the provider’s specific agreement.
• Customer-selected systems, such as Shopify — data may be exchanged when the customer enables an available integration. The role and instruction are assessed for each integration. Under the current product approach, Microsoft and Google mailboxes are connected to Svarlane Email through the customer’s forwarding rules.

3. Processing locations and safeguards

Providers’ public privacy and contractual pages describe possibilities and general terms. They do not establish which settings or agreements Svarlane has activated. Stated European data storage may include exceptions for support, security, telemetry and statutory disclosures.

Svarlane must document the actual contracting entity, countries where data is stored and made available, relevant DPA, transfer basis and necessary supplementary measures for the processing carried out. Optional providers receive data only to the extent covered by valid instructions and a legal basis for processing. A link to a provider’s terms alone does not conclude the necessary agreements. Documentation may be requested under the data processing agreement.

4. Changes and objections

The data processing agreement describes written advance notice and the customer’s opportunity to object to additions or replacements. Svarlane must maintain a versioned register that can be linked to the customer’s agreement and provide the necessary documentation on request.