Subprocessors
Last updated: 2026-09-10
The service providers that process personal data on behalf of uplads. This page is Annex 4 of our data processing agreement.
The processor informs the controller in advance, by email to the address held in the uplads account, of any intended addition or replacement of a subprocessor. The controller may object within two weeks on important data protection grounds (Section 8(2) and (3) of the agreement).
Subprocessors
These providers process personal data on our behalf.
| Name | Function | Location and transfer |
|---|---|---|
| Hetzner Online GmbH | Server hosting for the application and the background workers | EU (Germany, Falkenstein) |
| Supabase Pte. Ltd. / Supabase, Inc. | Database and authentication | Supabase Pte. Ltd. (Singapore) / Supabase, Inc. (USA); data held in AWS eu-west-1 (Ireland). EU standard contractual clauses under Art. 46(2)(c) GDPR are in place. |
| Cloudflare, Inc. | Object storage (R2) for uploaded creatives, CDN, DNS and attack protection | EU jurisdiction (data and processing exclusively in the EU), company in the USA. A DPF certification exists, supplemented by EU standard contractual clauses under Art. 46(2)(c) GDPR. |
| Anthropic PBC | AI model/API for ad copy, image analysis and the optimizer, when the AI is billed by uplads; additionally web research for uplads' own sales activity (no customer data) | Processing in the USA, no DPF listing. EU standard contractual clauses under Art. 46(2)(c) GDPR are in place. API data is not used to train the models; a limited retention for abuse monitoring under Anthropic's commercial terms remains possible. |
| OpenAI Ireland Ltd. | AI model/API for ad copy, image analysis and transcription of the audio track of uploaded videos, when the AI is billed by uplads | Contracting party OpenAI Ireland Ltd. (Ireland), processing in the USA, no DPF listing. EU standard contractual clauses under Art. 46(2)(c) GDPR are in place. API data is not used to train the models; API call logging is switched off, and a retention of up to 30 days for abuse monitoring remains possible. |
| Stripe Payments Europe Ltd. / Stripe, LLC | Payment processing and subscription management | Stripe Payments Europe Ltd. (Ireland) / Stripe, LLC (USA). A DPF certification exists, supplemented by EU standard contractual clauses under Art. 46(2)(c) GDPR. |
| PostHog, Inc. | Product analytics and session replay of the uplads interface | EU cloud (Germany, AWS eu-central-1), parent company in the USA. A DPF certification exists, supplemented by EU standard contractual clauses under Art. 46(2)(c) GDPR. |
| Crisp IM SAS | Support live chat in the application and on the website | France; messages stored in the Netherlands and Germany. Relay servers in the USA, the United Kingdom and Singapore process connection data only (IP address, time, browser identifier) and no message content; EU standard contractual clauses under Art. 46(2)(c) GDPR are in place for those. The chat is loaded only when you open it. |
| Plus Five Five, Inc. (Resend) | Delivery of system and notification emails | Sending from Ireland (eu-west-1), storage of metadata and logs in the USA. A DPF certification exists, supplemented by EU standard contractual clauses under Art. 46(2)(c) GDPR. |
| Redis Ltd. | Job queue for the background processing and rate limit counting | EU (Germany, AWS eu-central-1), parent company in the USA. EU standard contractual clauses under Art. 46(2)(c) GDPR are in place. |
OpenAI and Anthropic act as subprocessors only in so far as the use of the AI features is billed through the processor. If the controller stores its own API key for a provider, the processing concerned takes place on the basis of the contractual relationship between the controller and that provider, which is then the controller's own processor for it. Stored keys are held encrypted and are not returned to the controller's browser.
Recipients acting on your instructions
Advertising platforms the controller connects its own account to. They are not subprocessors of the processor: data is transmitted to them only on the controller's instructions, and that processing is governed by the contractual relationship between the controller and the platform concerned.
| Name | Function | Location and transfer |
|---|---|---|
| Meta Platforms Ireland Ltd. | The controller's Facebook and Instagram ad accounts | Ireland / USA |
| Google Ireland Ltd. | The controller's Google Ads and YouTube accounts | Ireland / USA |
| TikTok Technology Ltd. | The controller's TikTok ad accounts | Ireland |
| Snap Group Ltd. | The controller's Snapchat ad accounts | United Kingdom / USA |
| LinkedIn Ireland Unlimited Company | The controller's LinkedIn ad accounts | Ireland / USA |
Optional integrations
Used only where the controller connects them explicitly.
| Name | Function | Location and transfer |
|---|---|---|
| Dropbox International Unlimited Company | Importing creatives from the controller's Dropbox account | Ireland / USA |
| Google Ireland Ltd. (Drive) | Importing creatives from the controller's Google Drive | Ireland / USA |
| Slack Technologies Ltd. | Notifications into the controller's Slack workspace | Ireland / USA |
| ClickUp (Mango Technologies, Inc.) | Tasks in the controller's ClickUp workspace | USA |
Tools on our website
These tools run on uplads.com itself and process visitor data, not the data in your account. For them uplads is the controller in its own right, which is why they are listed here but not in Annex 4 of the data processing agreement. Everything marked as requiring consent runs only after you have allowed the corresponding category in the cookie banner.
| Name | Function | Location and transfer |
|---|---|---|
| Google Ireland Ltd. (Tag Manager, Analytics, Ads) | Tag management, reach measurement and conversion measurement on uplads.com, only after consent | Ireland / USA. A DPF certification exists, supplemented by EU standard contractual clauses. |
| Meta Platforms Ireland Ltd. (Meta-Pixel) | Measurement and remarketing of our own ads, joint controllership under Art. 26 GDPR, only after consent | Ireland / USA. A DPF certification exists. |
| Referly | Attributing a signup to a partner when the visitor arrives through a partner link, only after consent | USA. EU standard contractual clauses under Art. 46(2)(c) GDPR are in place. |
| Cal.com, Inc. | Booking demo appointments through an embedded booking window | USA. EU standard contractual clauses under Art. 46(2)(c) GDPR are in place. |