Sub-Processors
Last updated: 28 April 2026
Genitco operates a self-hosted infrastructure platform. Most personal data is processed exclusively on infrastructure we operate and control. The following third-party sub-processors are used where self-hosted alternatives are not available or practical.
For each sub-processor, a Data Processing Agreement (DPA) is in place. Where a sub-processor is outside the UK or EU, Standard Contractual Clauses (SCCs) under UK GDPR or EU GDPR cover the transfer.
Sub-processors used for your visit (United Kingdom)
Your resolved market (United Kingdom) does not narrow the sub-processor set. All 10 canonical sub-processors listed below apply.
| Sub-Processor | Country | Purpose | Data Categories | DPA | Reviewed |
|---|---|---|---|---|---|
| Scaleway SAS (TEM) | France (EU) | Transactional email delivery (TEM service) | Recipient email address, email content, delivery metadata | DPA | 2026-05-18 |
| Scaleway SAS (Generative APIs) | France (EU) | LLM inference — EU fallback when primary self-hosted model unavailable (Paris region) | Chat message content (user messages and AI responses), session metadata. PII-scrubbed before storage. | DPA | 2026-05-18 |
| Netcup GmbH | Germany (EU) | Server hosting (bare-metal compute nodes for the production cluster) | All personal data processed by Genitco services (infrastructure layer only) | DPA | 2026-05-18 |
| Hetzner Online GmbH | Germany (EU) | Infrastructure hosting (compute, storage, network) for all primary services | All personal data processed by Genitco services (infrastructure layer only) | DPA | 2026-04-27 |
| Cloudflare, Inc. | United States (SCCs in place) | DNS only (CDN role moved to Bunny.net 2026-05) | DNS query metadata (ephemeral) | DPA | 2026-05-18 |
| BunnyWay d.o.o. (Bunny.net) | Slovenia (EU) | Content delivery network for static website assets | Visitor IP address, HTTP request metadata | DPA | 2026-04-27 |
| Mistral AI SAS | France (EU) | AI language model — processes chat messages when the primary self-hosted model is unavailable (fallback path only) | Chat message content (user messages and AI responses), session metadata. PII-scrubbed before storage. | DPA | 2026-05-01 |
| Nebius B.V. (Token Factory) | EU (eu-north1, Finland) | AI language model — secondary fallback for chat when primary self-hosted model unavailable | Chat message content (user messages and AI responses), session metadata. PII-scrubbed before storage. | DPA | 2026-05-01 |
| GitHub, Inc. (Microsoft) | United States (public repos only) | Source code hosting for public repositories. No customer personal data. | Source code (no customer personal data) | DPA | 2026-04-27 |
| GitLab B.V. (self-hosted) | EU (self-hosted on Hetzner DE) | Internal source code, CI/CD, and issue tracking | Source code, CI logs (no customer personal data) | DPA | 2026-04-27 |
International transfers: Cloudflare (US) and GitHub (US) are covered by Standard Contractual Clauses. Scaleway, Hetzner, Bunny.net, Mistral AI, and Nebius are EU-incorporated or EU-hosted and require no transfer mechanism.
Changes to this list: we update this page when we add or remove sub-processors. Material changes notified via newsletter to opted-in subscribers.
Questions? Email hello@genitco.com.