Sub-processors
This page lists the third-party sub-processors we engage to provide the Service, in accordance with Article 28 GDPR and our Data Processing Agreement. We impose data-protection obligations on each sub-processor consistent with our DPA and remain responsible for their performance.
Current sub-processors
- Cloudflare R2 — object storage for uploaded media and encrypted database backups (via Litestream). Storage region: Western Europe (EU). Provider: Cloudflare, Inc. (international transfers covered by SCCs / EU-US Data Privacy Framework where applicable).
- Brevo (Sendinblue) — delivery of transactional email (approval requests and reminders). Provider established in France (EU).
- Hosting — a single virtual server located in Germany (EU).
Not currently used
Social-media publishing via third-party APIs (e.g., for automatic posting) is currently disabled. If enabled in the future, the relevant provider will be added to this page before processing begins.
Changes
We will update this page when we add or replace a sub-processor. Where you act as a controller under our DPA, you may object to a new sub-processor on reasonable data-protection grounds by contacting support@smapprove.com.