Deutsch
English
1. Overview
This page contains the current list of subprocessors engaged by Alpheris for operating the platform and related services.
- Scope: Hosting, AI processing, communication, billing and security services
- Legal basis: Art. 28 GDPR (processing on behalf of a controller)
- Transparency: Changes are notified within the scope of the DPA
2. Current subprocessors
| Provider | Purpose | Location / Processing | Data protection / DPA |
|---|---|---|---|
| Hetzner Online GmbH | Cloud infrastructure, hosting, database and server operations, and encrypted backup storage (Storage Box) | Germany / EU | Privacy Policy |
| Anthropic, PBC | AI text processing with the Claude language model: responses, automated checks, image descriptions and evaluations; inputs and outputs are not used for training and are generally deleted within 30 days | USA (EU Standard Contractual Clauses) | Data Processing Addendum |
| OpenAI | AI text processing (GPT language model) as a fallback and for load balancing when Anthropic is unavailable or overloaded, and as an independent second check of answers; under OpenAI's terms, API data is not used for training | USA (EU Standard Contractual Clauses) | Data Processing Addendum |
| Mistral AI | AI text processing, language model execution, embeddings, text recognition (OCR) and transcription | France (EU) | Data Processing Addendum |
| Microsoft (Microsoft 365 / Graph) | Delivery of Alpheris emails, business communication and Sign in with Microsoft (optional); integration activated by the merchant: Outlook mailbox (Graph) | EU data centers / US group | Privacy Statement |
| Cloudflare, Inc. | DNS, DDoS protection, security and performance proxy, email routing (receiving copies of shipping emails) | USA / Global | Privacy Policy |
| Stripe, Inc. | Payment processing and billing operations | USA | Privacy Policy |
| Apple Inc. | Account sign-in ("Sign in with Apple", optional) and delivery of push notifications to Apple devices on which they were enabled. A notification about a new customer message contains the channel, the sender and the subject or beginning of the message; the transmission is encrypted. | USA | Privacy Policy |
| Google LLC | Sign in with Google (optional) and delivery of push notifications to Android and Chrome devices; integration activated by the merchant: Gmail mailbox (email receiving/sending, see Privacy Policy 13.3) | USA | Privacy Policy (SCC / EU-US DPF) |
| Shopify International Ltd. | Integration activated by the merchant (only when installed via Shopify): provision of product, order, customer, inventory, shipping, discount and return data as well as store content from the connected store on behalf of the merchant, and app billing via Shopify Billing | Ireland / EU (group: Canada, USA) | Privacy Policy / DPA |
| Meta Platforms (Instagram, WhatsApp, Facebook login) | Integration activated by the merchant: social messaging channels (end-customer messages from Instagram/WhatsApp); the WhatsApp connection is made by signing in with Facebook | USA / Ireland | Privacy Policy (SCC / EU-US DPF) |
3. International data transfers
Where processing takes place outside the European Economic Area, appropriate safeguards pursuant to Art. 44 et seq. GDPR are applied.
- EU Standard Contractual Clauses (SCC)
- Adequacy decisions of the European Commission
- Other legally permitted protection mechanisms
4. Change notices and contact
In the event of changes or additions to this list, controllers will be informed within the scope of the contractual agreements.
For data protection questions or objections to changes, you can contact us at [email protected].
Contractual reference: Data Processing Agreement (DPA)