Subprocessors and platform recipients

Contabo — used for the production server, which runs the website, the API, and PostgreSQL. Status: used for the production server: the website, the API, the PostgreSQL database, and the backups kept on the server. Contracting entity: Contabo GmbH, Munich, Germany. Data region: European Union data centre. DPA: data processing agreement under Article 28 GDPR concluded with Contabo GmbH. Transfer safeguards: processing inside the European Union.

OVHcloud — used for private object storage, media delivery, and encrypted off-site backups. Status: used for private media storage and delivery and for encrypted off-site backups. Contracting entity: OVH GmbH, Saarbrücken, Germany (OVHcloud group). Data region: European Union data centres in Frankfurt, Germany. DPA: data processing agreement incorporated in the OVHcloud service contract. Transfer safeguards: processing inside the EU; any OVHcloud support access from outside the EU is covered by OVHcloud's Standard Contractual Clauses.

Cloudflare — used as the network proxy and attack protection in front of the website and the API. Status: used as the network proxy in front of selfpost.app and api.selfpost.app: it terminates TLS, filters attacks, and passes requests, including visitors' IP addresses, cookies, and media, on to the server. Contracting entity: Cloudflare, Inc., San Francisco, United States. Data region: Cloudflare's global network; a request is usually handled in the data centre closest to the visitor. DPA: Cloudflare Data Processing Addendum incorporated in the Cloudflare Self-Serve Subscription Agreement. Transfer safeguards: EU-US Data Privacy Framework certification of Cloudflare, Inc. and Standard Contractual Clauses in the Cloudflare Data Processing Addendum.

Zoho/ZeptoMail — used for transactional account, security, invitation, support, billing, and publishing email. Status: used for transactional email. Contracting entity: Zoho Corporation B.V., Utrecht, Netherlands (EU data centre). Data region: European Union. DPA: data processing addendum incorporated in the Zoho service terms. Transfer safeguards: EU data centre; remote support access is governed by Zoho's Standard Contractual Clauses.

Stripe — used for checkout, subscriptions, invoicing, fraud prevention, and payment recovery. Status: used for checkout, subscriptions, and invoicing. Contracting entity: Stripe Payments Europe, Limited, Dublin, Ireland. Data region: European Union with Stripe group processing in the United States under the EU-US Data Privacy Framework. DPA: Stripe Data Processing Agreement incorporated in the Stripe Services Agreement. Transfer safeguards: EU-US Data Privacy Framework certification of Stripe, Inc. and Standard Contractual Clauses.

OpenAI — used for Selfpost AI requests paid with Selfpost credits: captions, ideas, plans, insights, chat answers and video understanding. Status: used only for Selfpost AI requests that Selfpost pays for, through the weekly Selfpost AI of a plan or prepaid AI credits (writing, idea, planning and analysis features and video understanding); not used when a person connects their own ChatGPT plan or OpenAI key, where OpenAI acts under that person's own agreement. Contracting entity: OpenAI Ireland Limited, Dublin, Ireland. Data region: United States; API content is not used to train models. DPA: OpenAI Data Processing Addendum, part of the OpenAI Services Agreement under which Selfpost uses the OpenAI API. Transfer safeguards: Standard Contractual Clauses in OpenAI's Data Processing Addendum.

Meta Platforms Ireland Limited (Instagram) — status: used when you connect an Instagram professional account. Receiving entity: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland; Meta Platforms, Inc. (United States) under the EU-US Data Privacy Framework. Transfer safeguards: EU-US Data Privacy Framework and Meta's Standard Contractual Clauses.

TikTok Technology Limited (TikTok) — status: used when you connect a TikTok account. Receiving entity: TikTok Technology Limited, Dublin, Ireland and TikTok Information Technologies UK Limited, London; group companies outside the EEA may access data under TikTok's transfer safeguards. Transfer safeguards: European Commission Standard Contractual Clauses in TikTok's data processing terms plus TikTok's documented supplementary measures. Transfer assessment: Selfpost relies on the Standard Contractual Clauses and supplementary measures above; information about the transfer assessment is available from the privacy contact.

Google Ireland Limited (YouTube) — status: used when you connect a YouTube channel. Receiving entity: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google LLC (United States) under the EU-US Data Privacy Framework. Transfer safeguards: EU-US Data Privacy Framework and Google's Standard Contractual Clauses.

When enabled, these destinations receive content only after a user connects an account or instructs publication or analytics. Data can include platform identity, permissions, media, captions, settings, disclosure and audience choices, post identifiers, processing status, and analytics. They generally act under the user's separate platform relationship rather than as ordinary hosting subprocessors.

Business customers covered by the DPA receive reasonable advance notice of a new subprocessor by email or durable account notice and may object on reasonable data-protection grounds within 14 days. Emergency replacements required for security or availability may be notified as soon as reasonably possible.

Questions, current entity or region details, and safeguard requests can be sent to [email protected].