Legal
Sub-processors
The service providers that process personal data on behalf of Caudals: what each one does, what data it handles and where.
Version 2026-10-11
1.Current sub-processors
These providers may process personal data when you use Caudals. The last column says whether a provider can receive content from your workspace.
| Provider | What it does | Personal data | Location | Workspace content |
|---|---|---|---|---|
| Hetzner Online GmbH | Hosting of the application, databases, file storage and backups, on servers Caudals operates | All data held in the Service | Germany (EU) | Yes |
| Cloudflare, Inc. | Domain name service, encryption in transit and protection of our websites against attacks | Network traffic, including IP addresses and requests | Global network, United States company | In transit only |
| Amazon Web Services EMEA SARL | Hosting of our self-hosted website analytics and our sales tools, on a server Caudals operates | Website analytics, with your consent, and business contact details | Germany (EU) | No |
| Resend | Delivery of account, notification and newsletter emails | Email addresses and email content | United States | Only what a notification contains, such as the name of an evaluation |
| Sentry (Functional Software, Inc.) | Error monitoring for the application | Technical error reports, configured to exclude personal data by default | EU data region (Germany) | No |
| Stripe Payments Europe, Ltd. | Card payments for credit purchases and fraud screening | Company and billing contact details, payment details | Ireland (EU), with processing in the United States | No |
| Google (Gemini API) | AI model: fallback for the free public test when our own model is busy, and a model your workspace can choose | Public page text, questions and answers from the public test; workspace content only if your workspace chooses a Google model | United States and other countries | Only if your workspace chooses it |
| OpenRouter, Inc. | Access to AI models from several providers, which receive the request: fallback for the free public test, and models your workspace can choose | Public page text, questions and answers from the public test; workspace content only if your workspace chooses a model through OpenRouter | United States and other countries | Only if your workspace chooses it |
| NVIDIA (API catalog) | AI models your workspace can choose | Workspace content, only if your workspace chooses an NVIDIA-hosted model | United States | Only if your workspace chooses it |
| Cal.com, Inc. | Booking of meetings from our website | Name, email address and the details you add to a booking | United States | No |
Provider: Hetzner Online GmbH
- What it does
- Hosting of the application, databases, file storage and backups, on servers Caudals operates
- Personal data
- All data held in the Service
- Location
- Germany (EU)
- Workspace content
- Yes
Provider: Cloudflare, Inc.
- What it does
- Domain name service, encryption in transit and protection of our websites against attacks
- Personal data
- Network traffic, including IP addresses and requests
- Location
- Global network, United States company
- Workspace content
- In transit only
Provider: Amazon Web Services EMEA SARL
- What it does
- Hosting of our self-hosted website analytics and our sales tools, on a server Caudals operates
- Personal data
- Website analytics, with your consent, and business contact details
- Location
- Germany (EU)
- Workspace content
- No
Provider: Resend
- What it does
- Delivery of account, notification and newsletter emails
- Personal data
- Email addresses and email content
- Location
- United States
- Workspace content
- Only what a notification contains, such as the name of an evaluation
Provider: Sentry (Functional Software, Inc.)
- What it does
- Error monitoring for the application
- Personal data
- Technical error reports, configured to exclude personal data by default
- Location
- EU data region (Germany)
- Workspace content
- No
Provider: Stripe Payments Europe, Ltd.
- What it does
- Card payments for credit purchases and fraud screening
- Personal data
- Company and billing contact details, payment details
- Location
- Ireland (EU), with processing in the United States
- Workspace content
- No
Provider: Google (Gemini API)
- What it does
- AI model: fallback for the free public test when our own model is busy, and a model your workspace can choose
- Personal data
- Public page text, questions and answers from the public test; workspace content only if your workspace chooses a Google model
- Location
- United States and other countries
- Workspace content
- Only if your workspace chooses it
Provider: OpenRouter, Inc.
- What it does
- Access to AI models from several providers, which receive the request: fallback for the free public test, and models your workspace can choose
- Personal data
- Public page text, questions and answers from the public test; workspace content only if your workspace chooses a model through OpenRouter
- Location
- United States and other countries
- Workspace content
- Only if your workspace chooses it
Provider: NVIDIA (API catalog)
- What it does
- AI models your workspace can choose
- Personal data
- Workspace content, only if your workspace chooses an NVIDIA-hosted model
- Location
- United States
- Workspace content
- Only if your workspace chooses it
Provider: Cal.com, Inc.
- What it does
- Booking of meetings from our website
- Personal data
- Name, email address and the details you add to a booking
- Location
- United States
- Workspace content
- No
2.Run by Caudals itself
These parts of the Service run on infrastructure Caudals operates, with no provider involved beyond the hosting listed above:
- Our default AI model, which runs on a GPU server Caudals operates and connects to our hosting over a private encrypted tunnel.
- The database, file storage, browser workers and backups.
- Our website analytics, which we host ourselves.
3.Freelance domain experts
When you order expert review or a custom dataset, vetted freelance domain experts engaged by Caudals work on redacted material from your workspace. They see only what their task needs and work under confidentiality, data-processing and intellectual-property assignment terms. We tell you who they are on request.
4.Transfers outside the European Economic Area
For providers outside the European Economic Area, transfers rely on an adequacy decision, such as the EU–US Data Privacy Framework where the provider participates in it, or on the European Commission's standard contractual clauses.
5.Changes to this list
We update this page before a new sub-processor starts processing personal data. When it will process workspace content, we also email workspace owners at least 30 days in advance. To object, write to [email protected].