legal · 03

Sub-processors

Last updated: 2026-05-18. Version 1.0.

These third parties process personal data on AppScreen's behalf to deliver the service. Each entry lists what they do, what categories of data they see, where the data resides, and the transfer safeguard we rely on under GDPR Chapter V.

We notify active accounts by email at least 30 days before a new sub-processor goes live, and post the change to this page. If you object, you can terminate your account during the notice window with a pro-rata refund for the unused portion of a paid plan.

Contabo GmbH

purpose
Application server, Postgres database, render workers
data seen
Account profiles, projects, render metadata, email logs, audit logs
location
Düsseldorf, Germany (EU)
transfer safeguard
EU controller; no transfer outside EEA

Cloudflare R2

purpose
Object storage for project assets, render bundles, encrypted DB backups
data seen
Screenshot uploads, generated PNG bundles, age-encrypted Postgres dumps
location
EU jurisdiction, WEUR primary region
transfer safeguard
EU SCCs; data at rest in EU jurisdiction

Cloudflare Workers

purpose
Static site hosting + asset delivery for appscreen.co
data seen
No personal data — static HTML/CSS/JS only; request IPs visible in CF logs
location
Global edge, account billed to EU entity
transfer safeguard
EU SCCs

Google LLC (Firebase Authentication)

purpose
Sign-in (email/password, magic link, OAuth)
data seen
Email address, password hash (Google-managed), sign-in timestamps
location
United States
transfer safeguard
EU SCCs + EU-US Data Privacy Framework certification

Stripe Payments Europe Ltd. / Stripe Inc.

purpose
Pro subscription billing and invoicing
data seen
Email, billing name + address, card-tail, country, transaction history
location
Ireland (EU) + United States (parent)
transfer safeguard
EU SCCs

Resend

purpose
Transactional + marketing email delivery
data seen
Recipient email, subject, message-id, delivery status
location
EU region (eu-west-1)
transfer safeguard
EU SCCs where applicable

LibreTranslate (self-hosted)

purpose
Source-text translation for the auto-translate feature
data seen
Short text snippets submitted by Pro users
location
Same Contabo VPS in Düsseldorf, Germany
transfer safeguard
EU; no third-party transfer

Privacy notice: /privacy. DPA: /legal/dpa.