Subprocessors
Last updated: September 12, 2026
This list covers service providers used for wavebird infrastructure, accounts and business operations. A provider's role depends on the service and data flow described below. Advertising partners are assessed separately according to their contractual role and the data an integration sends to them.
We will notify customers at least 30 days before adding or replacing a subprocessor for production customer personal data, unless urgent security, legal or service-continuity reasons require shorter notice. Customers may object on reasonable data-protection grounds.
| Name / legal entity | Service | Role | Country / region | Data categories | Transfer mechanism | Used for |
|---|---|---|---|---|---|---|
| Hetzner Online GmbH | Core hosting and infrastructure | Processor / infrastructure provider | Nuremberg, Germany / EU | Website, dashboard, API, operational logs, account and project data where hosted | EU/EEA processing; no third-country transfer expected for the hosted region | wavebird.ai, dashboard and API hosting |
| Hetzner object storage | S3-compatible object storage and backups | Processor / infrastructure provider | Nuremberg, Germany / EU | Backups, signed AVV/DPA documents, proof or settlement artifacts where enabled | EU/EEA storage in the configured hosting region | Backup and document/object storage |
| IONOS SE | SMTP email delivery | Processor / email provider | Germany / EU | Recipient email, transactional email metadata, contact/support content sent by email | Transfer conditions follow the configured email service and its applicable processing agreement | Verification, support and contact email delivery |
| Microsoft Ireland Operations Limited / Microsoft group companies | Microsoft 365 and Teams | Processor / collaboration provider | EU and Microsoft global infrastructure | Booking/contact data, calendar metadata, Teams join links, business communications | EU Data Boundary, EU-US Data Privacy Framework and/or SCCs as applicable | Direct booking, calendar invites, Teams meetings and business collaboration |
| GitHub, Inc. | GitHub OAuth | Independent controller / authentication provider; processor status depends on account configuration | United States / global | OAuth provider account ID, email, username, display name and avatar URL where provided | EU-US Data Privacy Framework and/or SCCs as applicable | Optional dashboard OAuth signup/login/linking |
| Google Ireland Limited / Google LLC | Google OAuth; Google Analytics 4, Google Tag Manager and consent-bound Measurement Protocol for the consented public website and dashboard; Gemini only for demo/model-runner surfaces where enabled | Independent controller / authentication provider; analytics processor/provider and model-surface role depend on the applicable Google terms | EU, United States and global | OAuth profile data; consented website usage, route, campaign/referrer, browser/device and technical analytics data; prompt or model payloads only for separately noticed demo/model-runner surfaces | EU-US Data Privacy Framework and/or SCCs as applicable | Optional dashboard OAuth, consented public-website measurement through GA4/GTM, and optional demo/model-runner functionality |
| OpenAI, LLC | Model API for chat/demo/model-runner surfaces only where enabled | Processor or provider role depends on the enabled surface and contract | United States / global | Prompt and model payloads only for separately noticed demo/model-runner surfaces; not standard ad delivery | EU-US Data Privacy Framework and/or SCCs as applicable | Optional chat/demo/model-runner functionality |
| IONOS SE | Domain registration | Infrastructure provider | Germany / EU | Domain registration and administrative contact records | Domain registration data may be shared with the applicable registry as required to operate the domain | wavebird domain registration |
Partner status for advertising services
An advertising partner is not automatically a subprocessor. The applicable agreement must identify its role, processing purposes and any international transfer mechanism. Publisher-specific processing terms and authorized subprocessors are documented in the relevant agreement and annexes.