Subprocessors

On this page

1. The list
2. Things on this page that are not subprocessors
3. Meta and Google
4. How this list changes
5. Data Processing Agreement
6. Change history

The list

Subprocessor	What it does	What it can see	Where
Hetzner Online GmbH	Hosting and infrastructure: the servers the service and its database run on, and the Storage Box that holds the off-site copies of our backups.	Everything the service stores, as the infrastructure it sits on. Platform access tokens are encrypted by the service before they are stored. The backup copies are encrypted before they leave our server, and the key that opens them is not on the Storage Box.	Finland (the service, Helsinki) and Germany (encrypted backup copies, Falkenstein), EU
Anthropic PBC	Language-model requests: the chat that answers questions about an account, and the drafts of client updates.	Snapshots of ad-account metrics only: campaign names, budgets, spend, results and the other figures visible on your own screen. No personal data of end consumers, because the service does not hold any. No access tokens, no login credentials, no ability to call the ad platforms.	United States. Transfer safeguards: [to confirm: Standard Contractual Clauses (Commission Decision 2021/914), and the EU-US Data Privacy Framework where the receiving entity is certified]
[email provider, to be chosen]	Transactional email, once it is switched on: password links, invitations, and a morning email to your own team on days when something is waiting for them.	Names and email addresses of your team, and the content of the messages we send them.	[to be confirmed, EU preferred]
Telegram	Delivers alerts to our own staff's phones: a failed backup or job, a platform login about to expire, a halt being pulled, a new access request, an agency asking to be deleted.	The text of those alerts only. It can include an agency's name, an ad account's name and platform ID, the name of a connected platform login, and the name or email address of a person who pulled the halt (with the reason they typed), requested access, or asked for their agency to be deleted. The sign-up form inside the product, when it is switched on, also sends the sender’s IP address and the note they typed. No campaign data, access tokens or passwords.	[to be confirmed: Telegram's entity, location and transfer safeguard]
Zoho [to confirm: contracting entity]	The company mailbox, hello@adspenta.com.	Every email sent to us: deletion requests, privacy questions, support and replies to access requests, with the names and addresses in them.	[to confirm: data centre and transfer safeguard]
Stripe Payments Europe, Limited	Card payments: the 14-day trial, the monthly subscription, invoices and receipts, and the reminder before the first charge.	The billing name, address, email and VAT number you give at checkout, and your card. We never see or keep the full card number. Nothing inside the product.	Ireland, EU, with processing by Stripe in the United States. Transfer safeguards: [to confirm: Stripe’s Data Processing Agreement and its transfer mechanism]
Vercel Inc.	Hosts this website, adspenta.com. It does not host the product.	Each request to the website: IP address, page, browser description and time. Nothing inside the product.	United States. Transfer safeguards: [to confirm: Vercel’s Data Processing Addendum, and the EU-US Data Privacy Framework or Standard Contractual Clauses]

The unnamed entry is a placeholder for an email provider that has not been chosen yet. It will be named on this page, with a date, before it processes anything, and customers on an active plan will be told first.

Things on this page that are not subprocessors

Fonts, and everything else the browser loads

This website loads nothing from a third party until you accept the cookie banner. The three typefaces, Inter, JetBrains Mono and Lora, are served from adspenta.com itself under the SIL Open Font License 1.1. There is no font CDN, no analytics, no embedded video and no chat widget. If you accept the banner, the Google Ads tag is loaded from Google to count free trials and requests for access that came from our own ads; Google there serves our own advertising and never touches the data in the product, so it is not a subprocessor. The privacy policy sets out the cookie position.

Meta and Google

Meta and Google are not subprocessors. They are the platforms whose ad accounts you connect and control; we read from and write to them on your instruction, under your authorisation. Data flows to them because you told us to change something there.

The same goes for the mailbox a person on your team connects to send client updates from (Gmail or Microsoft 365): it is your own account, and an approved update goes through it only when that person presses Send.

How this list changes

Before a new subprocessor starts processing anything, it is added here with the date it was added, and customers on an active plan are told by email. If you object to a new subprocessor, tell us within 30 days and we will discuss it; if we cannot resolve it, you can terminate without penalty for the remainder of the period you have paid for.

Data Processing Agreement

Every customer will have a Data Processing Agreement as part of the terms, not as a feature of one plan. It covers this list, the security measures on the security page, the deletion commitments on the data deletion page, and notice of a new subprocessor before it starts. It is being written.

It will be published for download here once the company that will take over the service is registered and can sign it. [DPA: to be published]

Change history

Date	Change
[date]	List first published: Hetzner Online GmbH, Anthropic PBC.
12 October 2026	Stripe added, for card payments and the subscription, before the first payment is taken.
8 October 2026	Zoho (our mailbox) and Vercel (this website’s host) added: both were in use and missing from this list. Hetzner’s row: the service runs in Helsinki, and only the encrypted backup copies are in Germany. Telegram’s row: what the product’s own sign-up alert carries. The Google Ads tag on this website, loaded only if you accept, is described under Things on this page that are not subprocessors. The Data Processing Agreement is being written; it was described as available on request.
6 October 2026	Things on this page that are not subprocessors: the website now serves three typefaces, Lora added to Inter and JetBrains Mono, all from adspenta.com under the SIL Open Font License 1.1. No subprocessor was added or removed.
24 September 2026	Hetzner's row now includes the off-site backup copies, on a Storage Box in Falkenstein, Germany, in use since 13 September. From release 2.24 they are encrypted before they leave our server; the unencrypted copies made before it are deleted within 30 days of it. Telegram added: it had been carrying our staff's alerts since 14 September without being listed here. The email provider's row now lists the emails the product actually sends.

Back to top