Subprocessors
Version: 2026-10-15 Last updated: 2026-10-15
In short
These are the companies that help us run Readerr and process our Customers' personal data on our behalf. Our servers and backups are in the EU, and Audio files are stored in the EU. Some providers also process data outside the EU, for example the language model provider, the content delivery network and our email provider. We email Account owners 30 days before we add or replace a provider, and you can object. The rules are in section 8 of our Data Processing Agreement.
1. Current subprocessors
| Provider | What it does for Readerr | Where it processes data | Data it processes | Transfer mechanism |
|---|---|---|---|---|
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | Hosts our servers, including the database and speech synthesis, and stores backups and server snapshots | Germany (servers, including the database); Finland (a speech synthesis server, backups and snapshots) | All data we hold: article titles and texts until they are deleted, Audio, listening statistics, account data | Not needed: processing in the EU |
| Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, and its affiliates | Stores Audio files (object storage with EU jurisdiction); delivers the Player script and Audio to Listeners (content delivery network); receives listening events and keeps them for 3 months (serverless functions and analytics database); protects our website forms against bots; carries all traffic to our website, customer panel and API to our servers (network proxy and secure tunnel, which decrypts the traffic to pass it on); provides secure access to our admin tools | Audio storage: EU. Delivery, listening events and network traffic: Cloudflare's global network, at the location nearest to the Listener, visitor or sending server | Audio files; while in transit, everything sent to our website, customer panel and API, including the article texts and titles your Integration sends and Account data (we do not keep this traffic at Cloudflare); Listeners' IP address and browser information while a file is delivered (not stored by us); listening events (event type, file path, language, article identifier, site host, with no IP address or identifier); IP address and browser signals of visitors to our website forms | EU-U.S. Data Privacy Framework; EU standard contractual clauses if that framework no longer applies |
| Google Cloud Poland sp. z o.o. (our contracting party for the Gemini API), with processing by Google LLC, Mountain View, CA, USA, and its affiliates | Runs the large language model that reads each article and returns hints on how to pronounce it (paid Gemini API) | Globally, wherever Google or its agents maintain facilities, including the USA | The full text of each article | EU-U.S. Data Privacy Framework (Google LLC is certified); EU standard contractual clauses |
| Plus Five Five, Inc. (trading as Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA | Sends our emails, for example sign-in links and service notices | Emails are sent from the EU (Ireland). Account data, email metadata and logs are stored in the USA | Recipient email address; subject and content of the email | EU-U.S. Data Privacy Framework; EU standard contractual clauses |
| Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, the Netherlands, and its group companies | Hosts our mailbox [email protected], where messages from Customers and others arrive, for example complaints, reports of content and privacy requests | Zoho data centres in the EEA; Zoho group companies in India may access data for support and debugging | Content of messages sent to us and our replies, which may include Customer Personal Data a Customer or another person chooses to send | Zoho's data processing addendum (EU standard contractual clauses between controller and processor, art. 28(7) GDPR); for access from India, Zoho ensures a transfer basis required by the GDPR (DPA clause 5.2) |
About the language model provider. Under Google's terms for paid Gemini API services, Google does not use prompts or responses to improve its products. It processes them under its data processing terms, in which Google acts as a processor. Google logs prompts and responses for a limited period (currently 55 days), solely to detect and prevent violations of its prohibited use policy and for legal or regulatory disclosures that are required; prompts flagged in that process may be reviewed by authorised Google staff. Google may also keep prompts briefly in memory (not on disk) to speed up repeated requests. We do not use the optional Gemini API features that keep more data (logging of our requests in Google's console, or grounding with Google Search).
About the email provider. Most of our emails contain personal data for which we are the controller, such as your sign-in email address. Our Privacy Policy describes that processing.
About bot protection. The bot protection on our website forms processes data of visitors to readerr.app, for which we are the controller. Cloudflare also uses these signals as a separate controller to improve its bot detection. Our Privacy Policy describes that processing.
2. Services that are not our subprocessors
- Link (Sold through Link, LLC, a company in the Stripe group) is the merchant of record for Readerr. It takes payments, charges VAT and issues invoices and receipts. Link acts as a separate controller under its own terms, not on our behalf. See our Privacy Policy and the Terms.
- Google Analytics runs only on our own website, readerr.app, and only after a visitor consents. It never runs on Publisher Sites or in the Player. See our Privacy Policy and Cookie Policy.
- GitHub hosts our source code and build pipeline. It does not process personal data from Readerr.
3. How we notify changes
3.1. Before we add or replace a subprocessor, we email the owners of all Accounts at least 30 days before the new provider starts processing Customer Personal Data. We update this page at the same time.
3.2. If we have to replace a provider urgently, for example because the provider stops offering its service or because of a security risk, we notify you as soon as possible. You have the same right to object.
3.3. You may object on reasonable grounds relating to data protection. If we cannot resolve your objection, you may end the contract and receive a proportional refund of the prepaid fees for the unused part of the paid period. The details are in section 8 of the Data Processing Agreement.
3.4. Questions about this list: [email protected].