Subprocessors
Last updated: April 26, 2026
This list covers subprocessors and infrastructure providers used for the controlled wavebird B2B pilot. No production SSP subprocessors are currently used for live customer traffic. SSP partners will be listed before production use, together with their role, country, data categories and transfer mechanism.
We will notify customers at least 30 days before adding or replacing a subprocessor for production customer personal data, unless urgent security, legal or service-continuity reasons require shorter notice. Customers may object on reasonable data-protection grounds.
| Name / legal entity | Service | Role | Country / region | Data categories | Transfer mechanism | Used for |
|---|---|---|---|---|---|---|
| Hetzner Online GmbH | Core hosting and infrastructure | Processor / infrastructure provider | Germany / EU | Website, dashboard, API, operational logs, account and project data where hosted | EU/EEA processing; no third-country transfer expected for the hosted region | wavebird.ai, dashboard and API hosting |
| Hetzner object storage | S3-compatible object storage and backups | Processor / infrastructure provider | OPERATOR_REQUIRED — expected EU/Germany but not externally verified in this review | Backups, signed AVV/DPA documents, proof or settlement artifacts where enabled | EU/EEA processing expected; lifecycle and region are operator facts to verify | Backup and document/object storage |
| IONOS SE | SMTP email delivery | Processor / email provider | Germany / EU | Recipient email, transactional email metadata, contact/support content sent by email | EU/EEA processing expected; mailbox retention is an operator fact to verify | Verification, support and contact email delivery |
| Microsoft Ireland Operations Limited / Microsoft group companies | Microsoft 365 and Teams | Processor / collaboration provider | EU and Microsoft global infrastructure | Booking/contact data, calendar metadata, Teams join links, business communications | EU Data Boundary, EU-US Data Privacy Framework and/or SCCs as applicable | Direct booking, calendar invites, Teams meetings and business collaboration |
| GitHub, Inc. | GitHub OAuth | Independent controller / authentication provider; processor status depends on account configuration | United States / global | OAuth provider account ID, email, username, display name and avatar URL where provided | EU-US Data Privacy Framework and/or SCCs as applicable | Optional dashboard OAuth signup/login/linking |
| Google Ireland Limited / Google LLC | Google OAuth; Gemini only for demo/model-runner surfaces where enabled | Independent controller / authentication provider; processor or provider role depends on model-surface contract | EU, United States and global | OAuth profile data; prompt or model payloads only for separately noticed demo/model-runner surfaces | EU-US Data Privacy Framework and/or SCCs as applicable | Optional dashboard OAuth and optional demo/model-runner functionality |
| OpenAI, LLC | Model API for chat/demo/model-runner surfaces only where enabled | Processor or provider role depends on the enabled surface and contract | United States / global | Prompt and model payloads only for separately noticed demo/model-runner surfaces; not standard ad delivery | EU-US Data Privacy Framework and/or SCCs as applicable | Optional chat/demo/model-runner functionality |
| DNS provider / registrar | Domain registration and DNS | Infrastructure provider | Operator fact to verify | Domain/admin records and DNS logs where applicable | Operator fact to verify | Domain registration and DNS resolution |
Partner status
Production SSP traffic is not currently represented as legally ready. Unnamed SSP partners are not used as production subprocessors for live customer traffic.