Sub-processors

Overview

These providers process personal data for letr.dev, apart from Stripe and Link, which are listed for transparency and are not sub-processors. Hetzner, Cloudflare and Contabo also process the emails customers send through letr.dev, on those customers' behalf. The privacy policy describes the processing for which Viascom GmbH is the controller.

Hetzner Online GmbH

• Purpose: Hosting of the website, the API, the database and the mail servers
• Location: Germany
• Data: Account and billing details, sending domains and API keys, the emails customers send and their delivery events, suppression lists, server logs
• Transfer basis: None needed: Germany is in the EU, and Switzerland recognises its data protection as adequate

Cloudflare, Inc.

• Purpose: DNS, content delivery and protection against attacks for the website and the API
• Location: USA
• Data: IP addresses and connection data of visitors, and API requests in transit, including the recipients and content of emails
• Transfer basis: EU-US and Swiss-US Data Privacy Framework

Contabo GmbH

• Purpose: Storage of the encrypted backups of the database
• Location: EU
• Data: Encrypted backups of the database: account and billing details, sending domains and API keys, the emails customers send and their delivery events, suppression lists
• Transfer basis: None needed: the storage is in the EU, and Switzerland recognises its data protection as adequate

Stripe (separate controller) and Sold through Link, LLC (merchant of record)

• Purpose: Payment and sale as merchant of record, under their own privacy notice
• Location: Depends on the transaction; Stripe's documentation names Stripe Payments Company, Stripe Technology Europe, Limited and affiliates in Canada, Singapore and Australia
• Data: Name, email address, billing address, tax ID and payment details of paying customers, and the website and use case from the signup form
• Transfer basis: For what it collects in Checkout, Stripe answers as a separate controller; see its privacy notice

WorkOS, Inc.

• Purpose: Sign-in to the dashboard
• Location: USA
• Data: Email address, name, sign-in credentials, and the IP address and browser of each sign-in
• Transfer basis: Standard contractual clauses of the European Commission, with the amendments for Switzerland

Datadog, Inc.

• Purpose: Monitoring of the servers, the web server and the mail server software
• Location: USA
• Data: Server health and process metrics; the web server's error log (client IP addresses and requested URLs, which can contain email addresses); the mail server's operational log (warnings, errors and sending rate decisions, with the IP addresses and domains of connecting and receiving mail servers), with email addresses masked before they leave the server
• Transfer basis: EU-US and Swiss-US Data Privacy Framework

Google Cloud EMEA Limited

• Purpose: Google Workspace: letr.dev's mailboxes, including the one that receives the support requests sent from the dashboard
• Location: Ireland, with processing in Google's data centres worldwide, including the USA
• Data: Emails to letr.dev addresses, support requests and abuse reports about customers' emails: the sender's email address, the account name and ID, and the message, which can contain recipient addresses, email headers or email content
• Transfer basis: EU-US and Swiss-US Data Privacy Framework (Google LLC) for the USA; for other countries, the standard contractual clauses in Google's Cloud Data Processing Addendum

Changes

We announce a new or replaced sub-processor by email to account owners at least 30 days before it starts processing data. If you object, you can terminate your contract before the change takes effect.