Service providers and sub-processors
Every third party involved in running miraride, what each is used for, where it is, and the basis for any transfer of personal data.
On this page
- About this list
- Hetzner Online GmbH
- Cloudflare, Inc.
- Plus Five Five, Inc. d/b/a Resend
- Functional Software, Inc. d/b/a Sentry
- Stripe Payments Europe, Limited
- OpenAI Ireland Limited
- Google Ireland Limited — independent controller
- Changes to this list
About this list
A sub-processor is a company we engage to process dealer-controlled personal data. Other service providers may process platform billing or security data in a different legal role. This page identifies both and states the applicable role.
You give general authorisation to these sub-processors when you accept the data processing agreement. Before we add or replace one, we give at least thirty days' notice by email and update this page. You may object on reasonable data protection grounds within that period.
The list is short on purpose. Every additional company with access to customer data is another company you have to trust, and we would rather run one more thing ourselves than add one.
Hetzner Online GmbH
Hosting of the application, the database, background processing, and encrypted database backups. This is where your dealership's records actually live.
- All processing takes place in data centres in Germany. No transfer outside the European Economic Area arises from this sub-processor.
Cloudflare, Inc.
Domain name resolution, content delivery and TLS termination in front of the service, and object storage for vehicle photographs, dealership branding assets, and backup archives.
- Cloudflare is established in the United States and delivers the service through a global network, including locations in the European Union.
- Personal data reaching Cloudflare consists of the technical data inherent in serving a web request, and any personal data contained in an uploaded image or document stored in object storage.
Plus Five Five, Inc. d/b/a Resend
Delivery of transactional email: documents you send to a customer, team invitations, password resets, and service notices.
- Resend is established in the United States.
- Personal data reaching Resend consists of the recipient's email address and the content of the message, including any attached document you chose to send.
Functional Software, Inc. d/b/a Sentry
Error monitoring for the browser, web application, API, and background workers. The project stores error events in Germany and is configured without replay, performance tracing, profiling, or default personal data.
- Diagnostic events are scrubbed before transmission and retained for no more than thirty days.
- Transfers involving the United States rely on Sentry's data processing terms, the EU-US Data Privacy Framework where applicable, and Standard Contractual Clauses.
Stripe Payments Europe, Limited
Subscription checkout, saved payment methods, tax calculation, invoices, payment recovery, and the customer billing portal.
- Stripe processes billing contact, address, tax ID, payment-method, invoice, and transaction data. miraride does not store complete card details and does not send dealer customer records to Stripe.
- Stripe acts as an independent controller for some regulated payment activities and as a processor where its terms specify that role. International processing uses the safeguards in Stripe's privacy and data processing terms.
OpenAI Ireland Limited
Optional, user-initiated AI assistance for extracting proposed vehicle fields from submitted screenshots and proposing translations. Manual workflows remain available and no result is saved, published, or issued without human review.
- Requests use store=false and API data is not used to train provider models by default.
- OpenAI may retain abuse-monitoring logs for up to thirty days under its standard API controls unless Zero Data Retention or Modified Abuse Monitoring is verified for the production project. International processing uses OpenAI's DPA and transfer safeguards.
Google Ireland Limited — independent controller
Address suggestions are loaded only while a user types in an address-search field. The search query and technical request data go directly to Google Maps Platform under Google's own privacy terms.
- Google acts as an independent controller for this address-search processing, not as our sub-processor for dealer customer records.
- Users can enter an address manually instead of selecting a Google suggestion.
Changes to this list
The version and date at the top of this page change whenever this list changes. We keep previous versions and will provide any of them on request.