Service providers and sub-processors

About this list

A sub-processor is a company we engage to process dealer-controlled personal data. Other service providers may process platform billing or security data in a different legal role. This page identifies both and states the applicable role.

You give general authorisation to these sub-processors when you accept the data processing agreement. Before we add or replace one, we give at least thirty days' notice by email and update this page. You may object on reasonable data protection grounds within that period.

The list is short on purpose. Every additional company with access to customer data is another company you have to trust, and we would rather run one more thing ourselves than add one.

Hetzner Online GmbH

Hosting of the application, the database, background processing, and encrypted database backups. This is where your dealership's records actually live.

• All processing takes place in data centres in Germany. No transfer outside the European Economic Area arises from this sub-processor.

Cloudflare, Inc.

Domain name resolution, content delivery and TLS termination in front of the service, and object storage for vehicle photographs, dealership branding assets, and backup archives.

• Cloudflare is established in the United States and delivers the service through a global network, including locations in the European Union.
• As sub-processor for dealer data, Cloudflare can handle request contents, form submissions, cookies, IP addresses and stored images or documents through TLS termination, security and storage. Processing uses a global network. Restricted transfers rely on Cloudflare’s DPA and EU Standard Contractual Clauses with supplementary safeguards, or an applicable adequacy decision.

Plus Five Five, Inc. d/b/a Resend

Delivery of transactional email: documents you send to a customer, team invitations, password resets, and service notices.

• Resend is a sub-processor for dealer-directed email and a provider for platform transactional messages, established in the US. Restricted transfers use its DPA and EU Standard Contractual Clauses with appropriate safeguards. Provider message and delivery logs have their own retention schedule; account and legally required records may be retained separately.
• Personal data reaching Resend consists of the recipient's email address and the content of the message, including any attached document you chose to send.

Functional Software, Inc. d/b/a Sentry

Error monitoring for the browser, web application, API, and background workers. The project stores error events in Germany and is configured without replay, performance tracing, profiling, or default personal data.

• Diagnostic events are scrubbed before transmission and retained for no more than thirty days.
• Transfers involving the United States rely on Sentry's data processing terms, the EU-US Data Privacy Framework where applicable, and Standard Contractual Clauses.

Stripe Payments Europe, Limited

Subscription checkout, saved payment methods, tax calculation, invoices, payment recovery, and the customer billing portal.

• Stripe processes billing contact, address, tax ID, payment-method, invoice, and transaction data. miraride does not store complete card details and does not send dealer customer records to Stripe.
• Stripe acts as an independent controller for some regulated payment activities and as a processor where its terms specify that role. International processing uses the safeguards in Stripe's privacy and data processing terms.

OpenAI Ireland Limited

Optional AI actions send submitted material and the context needed for vehicle extraction, translation or blank document-template assistance, plus a pseudonymous safety identifier, to OpenAI. Requests use store=false, which does not mean zero retention. API input is not used for training by default; standard abuse logs may be held up to thirty days, with longer retention where required by law or reasonably necessary to protect OpenAI’s services or third parties from harm. Do not submit unnecessary personal or confidential material.

• Requests use store=false and API data is not used to train provider models by default.
• OpenAI normally retains abuse-monitoring logs for up to thirty days, with longer retention where required by law or reasonably necessary to protect its services or third parties from harm. Zero Data Retention and Modified Abuse Monitoring require approval and have provider-defined limitations; setting store=false alone does not enable these controls. International processing uses OpenAI's DPA and transfer safeguards.

Google Ireland Limited — independent controller

Address suggestions use our server to send the typed query, language, country filters, session token and selected place identifier to Google Maps Platform. We do not forward your browser IP address to Google for this lookup. Google processes the server request under its own privacy terms as an independent controller. Manual entry is available.

• Google acts as an independent controller for this address-search processing, not as our sub-processor for dealer customer records.
• Users can enter an address manually instead of selecting a Google suggestion.

Changes to this list

The version and date at the top of this page change whenever this list changes. We keep previous versions and will provide any of them on request.