Sub-processors

Mitves processes personal data on behalf of the companies that use it (controllers) under the data processing agreement. These are the sub-processors Mitves engages for that, with their purpose, the data they receive and the safeguard for any transfer outside the EU/EEA. Customer data is hosted in the European Union.

Mitves announces an intended addition or replacement at least 30 days in advance here, in the dashboard and by e-mail to the administrators; the change log below keeps the history. Customers may object as set out in the data processing agreement.

• Country: Netherlands

• Purpose: Virtual private servers that run the Mitves service: application, database, uploaded files and encrypted backups.

• Data: All customer data processed in the Service.

• Location and transfer safeguard: Processing in the EU; no transfer outside the EU/EEA.

• Address: 101 Townsend St, San Francisco, CA 94107, United States

• Purpose: DNS, TLS and reverse-proxy edge protection for all traffic; the Turnstile bot check at sign-up.

• Data: IP addresses and request data of every visit and app call; the content of requests passes through in encrypted transit.

• Location and transfer safeguard: United States: the provider is certified under the EU–US Data Privacy Framework (adequacy decision); the EU standard contractual clauses apply as fallback.

• Address: 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States

• Purpose: Firebase Crashlytics crash reports and Firebase Cloud Messaging push notifications for the mobile app.

• Data: Crash reports (error type, stack trace, device model, operating system and app version, a random installation identifier, IP address); push tokens and the fixed title and text of each push, never a person’s name.

• Location and transfer safeguard: United States: the provider is certified under the EU–US Data Privacy Framework (adequacy decision); the EU standard contractual clauses apply as fallback.

• Address: 38 Avenue John F. Kennedy, L-1855 Luxembourg, Germany (Frankfurt)

• Purpose: Amazon SNS for text messages (one-time codes and setup links), Amazon SES for the Service’s e-mails (setup links, daily digest, notices) and Amazon S3 for the off-site copy of the encrypted backups.

• Data: Mobile phone numbers, e-mail addresses and the content of those messages; backups are encrypted before upload, so AWS cannot read them, and are deleted after 14 days.

• Location and transfer safeguard: Processing in the EU region Frankfurt (eu-central-1); the parent company is in the United States, so the EU–US Data Privacy Framework and the EU standard contractual clauses cover any access from there.

• Address: Beneluxlaan 4B, 3527 HT Utrecht, Netherlands

• Purpose: Zoho Mail mailboxes for support, billing and contact (hello@, support@, billing@ mitves.com).

• Data: What customers and users write to us, with their names and e-mail addresses.

• Location and transfer safeguard: Processing in the EU; no transfer outside the EU/EEA.

• Apple Inc. (United States): Apple Push Notification service delivers the push notifications that Firebase passes on to iPhones.

• OpenStreetMap Foundation (United Kingdom): serves map tiles to administrators’ browsers in the web dashboard.

• Stripe Payments Europe, Ltd. (Ireland) and PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg): process the customer’s own payment data for licence purchases as independent controllers.

• European Commission, VAT Information Exchange System (VIES): receives the customer’s VAT ID, with Mitves’s VAT ID as requester, for the check before a licence is sold without German VAT.

2026-10-10: First publication of this list: hosting, Cloudflare, Google Firebase, Amazon Web Services (SNS text messages, SES e-mail, S3 encrypted backups) and Zoho Mail.