Subprocessors and data transfer safeguards
Duale AI lists the subprocessors that process personal data for its services and the transfer safeguards applied to each.
Lists subprocessors processing personal data for Duale AI services, with notice periods, transfer safeguards, and processing locations for each.
- Duale AI gives 30 days notice for EEA subprocessors and 90 days for non-EEA additions.
- International transfers rely on the Data Privacy Framework or 2021 standard contractual clauses.
- Authentication runs internally on Hetzner infrastructure in Germany with no external identity provider.
- Customers choose and contract directly with AI model providers; Duale AI does not impose them.
- Duale AI uses no third-party audience measurement or monitoring service that collects personal data.
Summaries were generated by AI. Generative AI is experimental.
Introduction
This page lists the subprocessors that can process personal data to provide, host, or secure Duale AI services.
Changes
Duale AI notifies you by email before it adds or replaces a subprocessor:
- 30 days ahead, if the subprocessor is in the European Economic Area;
- 90 days ahead, if it is outside the European Economic Area.
You have the right to object in writing within that period: contact+legal@mail.duale.ai
International Transfers
Transfers outside the European Economic Area rely on the Data Privacy Framework where it applies, or on the 2021 standard contractual clauses with supplementary measures where required.
Infrastructure, Hosting and Network Security
- Subprocessor
- Hetzner Online GmbH
- Service Provided
- Hosting of Duale AI application infrastructure
- Personal Data Concerned
- Account, authentication and usage data, content needed for the service, technical logs
- Processing Location
- Germany, European Economic Area
- Transfer Safeguards
- No transfer outside the European Economic Area for this processing
- Subprocessor
- Cloudflare, Inc.
- Service Provided
- Website hosting, content delivery, network protection and domain name resolution
- Personal Data Concerned
- IP address, user agent, URL, request headers, traffic metadata, security logs
- Processing Location
- Cloudflare global network
- Transfer Safeguards
- Data Privacy Framework where it applies; 2021 standard contractual clauses with supplementary measures where required
- Subprocessor
- Quad9 Foundation
- Service Provided
- Domain name resolution, with protection against known malicious sites
- Personal Data Concerned
- Web addresses requested by the service
- Processing Location
- Switzerland
- Transfer Safeguards
- European Commission adequacy decision for Switzerland
Authentication
Duale AI operates authentication internally, on Hetzner infrastructure in Germany. It uses no external identity provider.
Duale AI sends authentication email, such as a password reset or a one-time code, through the transactional email provider below.
- Subprocessor
- Twilio Inc. (SendGrid)
- Service Provided
- Transactional email delivery
- Personal Data Concerned
- Email address, authentication message content
- Processing Location
- United States
- Transfer Safeguards
- Data Privacy Framework where it applies; 2021 standard contractual clauses with supplementary measures where required
Artificial Intelligence Services
The Customer chooses and contracts directly with its model providers. These providers are not subprocessors imposed by Duale AI.
Duale AI internally processes routing and contextual memory on Hetzner infrastructure in Germany. Duale AI does not reuse that data outside the Customer’s context, either to train a model or to produce statistics.
Payment and Billing
- Subprocessor
- Stripe Payments Europe, Ltd.
- Service Provided
- Payment processing
- Personal Data Concerned
- Banking data, email address
- Processing Location
- Ireland / United States
- Transfer Safeguards
- European Union-United States Data Privacy Framework where applicable; 2021 standard contractual clauses and supplementary measures where required
- Subprocessor
- Pennylane SAS
- Service Provided
- Invoicing and accounting
- Personal Data Concerned
- Billing name, billing address, invoice lines
- Processing Location
- France, European Economic Area
- Transfer Safeguards
- No transfer outside the European Economic Area for this processing
- Subprocessor
- Loqate, a GBG company
- Service Provided
- Billing address validation and autocomplete
- Personal Data Concerned
- Address entered and the resolved address
- Processing Location
- United Kingdom
- Transfer Safeguards
- European Commission adequacy decision for the United Kingdom
Note: Duale AI does not store credit card numbers.
Public Administrative Services
To validate a company identity and a VAT number, Duale AI queries two public administrative services. They act as recipients of the data Duale AI sends them, not as subprocessors acting on Duale AI’s instructions.
- Recipient
- Recherche d’entreprises, a French public administration service
- Purpose
- Company identity lookup
- Data Sent
- Company name or identifier
- Processing Location
- France, European Economic Area
- Recipient
- VIES, operated by the European Commission
- Purpose
- VAT number validation
- Data Sent
- VAT number and its member state
- Processing Location
- European Union
Communication and Support
- Subprocessor
- Crisp IM SAS
- Service Provided
- Customer support, chat
- Personal Data Concerned
- Email, name, ticket content
- Processing Location
- European Economic Area
- Transfer Safeguards
- No transfer outside the European Economic Area
Third-party audience measurement and monitoring
Duale AI uses no third-party audience measurement or monitoring service that collects personal data. This does not cover the usage analytics Duale AI produces itself, on its own infrastructure.
Contact
- Questions: contact+privacy@mail.duale.ai
- Data processing agreement request: contact+dpa@mail.duale.ai