--- title: "List of subprocessors handling personal data" description: "Lists Duale AI's subprocessors—including Hetzner, Cloudflare, Stripe, and Crisp—showing data types processed, locations, transfer safeguards, and notice periods." lang: en lastUpdated: 2026-06-07 url: https://duale.ai/en/legal/subprocessors --- ## AI-generated summary This page lists Duale AI’s subprocessors handling personal data, details the data categories each processes, their processing locations, and transfer safeguards, and explains notice periods for changes, authentication and AI model responsibilities, and contact points for privacy inquiries. - Duale AI emails customers 30 days before adding or replacing EEA‑based subprocessors and 90 days for non‑EEA subprocessors; objections go to . - Hetzner Online GmbH hosts Duale AI’s application infrastructure in Germany, processing account, authentication, usage and technical‑log data, with no transfers outside the EEA. - Cloudflare provides website hosting, CDN and network protection, processing IPs, user‑agents, URLs and security logs; transfers rely on the Data Privacy Framework or 2021 SCCs. - Stripe Payments Europe handles payment processing, storing banking data and email addresses in Ireland and the U.S.; transfers use the EU‑US Data Privacy Framework or 2021 SCCs. - Duale AI does not store credit card numbers and does not use third‑party analytics or monitoring services that collect personal data. Summaries were generated by AI. Generative AI is experimental. --- ## Introduction List of subprocessors that may process personal data to provide, host, or secure Duale AI services. ## Changes Duale AI notifies Customers by email before any addition or replacement: - **30 days** prior notice for European Economic Area-based subprocessors - **90 days** prior notice for subprocessors outside the European Economic Area Objections: ## International Transfers Transfers outside the European Economic Area rely on the Data Privacy Framework where it applies, or on the 2021 standard contractual clauses with supplementary measures where required. --- ## Infrastructure, Hosting and Network Security | Subprocessor | Service Provided | Personal Data Concerned | Processing Location | Transfer Safeguards | | ------------------- | -------------------------------------------------------- | -------------------------------------------------------------------------------------- | ------------------------------- | --------------------------------------------------------------------------------------------------------------------- | | Hetzner Online GmbH | Hosting of Duale AI application infrastructure | Account, authentication and usage data, content needed for the service, technical logs | Germany, European Economic Area | No transfer outside the European Economic Area for this processing | | Cloudflare, Inc. | Website hosting, content delivery and network protection | IP address, user agent, URL, request headers, traffic metadata, security logs | Cloudflare global network | Data Privacy Framework where it applies; 2021 standard contractual clauses with supplementary measures where required | ## Authentication Authentication is operated internally on Hetzner infrastructure in Germany. No external identity provider is used. ## Artificial Intelligence Services Customer chooses and contracts directly with model providers. These providers are not subprocessors imposed by Duale AI. Duale AI internally processes routing and contextual memory on Hetzner infrastructure in Germany. Data is not reused outside the Customer context, for training, or for statistics. ## Payment and Billing | Subprocessor | Service Provided | Personal Data Concerned | Processing Location | Transfer Safeguards | | ---------------------------- | ------------------ | --------------------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | | Stripe Payments Europe, Ltd. | Payment processing | Banking data, email address | Ireland / United States | European Union-United States Data Privacy Framework where applicable; 2021 standard contractual clauses and supplementary measures where required | **Note:** Duale AI does not store credit card numbers. ## Communication and Support | Subprocessor | Service Provided | Personal Data Concerned | Processing Location | Transfer Safeguards | | ------------ | ---------------------- | --------------------------- | ---------------------- | -------------------------------------------------------- | | Crisp IM SAS | Customer support, chat | Email, name, ticket content | European Economic Area | No transfer outside the European Economic Area indicated | ## Analytics and Monitoring Duale AI does not use third-party analytics or monitoring services that collect personal data. ## Contact - **Questions:** - **Data processing agreement request:** ## Related content - [Privacy policy and data protection details](https://duale.ai/en/legal/privacy.md) - [Security Trust Center for production AI agents](https://duale.ai/en/product/security.md) - [Govern AI agents in production with shared operating signals](https://duale.ai/en/solutions/governance.md) - [Terms of Use for platform services](https://duale.ai/en/legal/cgu.md) - [Terms and conditions for SaaS service](https://duale.ai/en/legal/cgv.md) - [Production runtime for durable AI agents](https://duale.ai/en/home.md) --- ## Sitemap See the full [Markdown sitemap](https://duale.ai/sitemap.md) for all pages.