Subprocessors
Version 1.0 · Last updated 14 October 2026
1. About this list
1.1 When you use the Voidhash Service, Voidhash s.r.o. processes personal data of your End Users on your behalf as a processor. To provide the Service, we engage other companies ("subprocessors") that may process this data. This page lists them, together with the services Voidhash uses for its own customer relationship.
1.2 This page forms Annex III of the Data Processing Addendum at https://voidhash.com/legal/dpa ("DPA", section 9), which is part of the Terms of Service at https://voidhash.com/legal/terms. Capitalised terms have the meaning given in the Terms of Service and in the DPA.
1.3 Every subprocessor is bound by a written agreement with data protection obligations at least as protective as those in the DPA. Voidhash remains responsible for its subprocessors.
2. How we notify changes and how to subscribe
2.1 We notify you at least 30 days before a new subprocessor starts processing Customer Personal Data. The notice states the subprocessor's name, purpose, the data concerned, the processing location and the transfer mechanism.
2.2 Notices are sent:
- automatically by email to the owners of every Voidhash organisation; and
- to anyone who subscribes to updates by emailing legal@voidhash.com with the subject "Subscribe to subprocessor updates".
2.3 You may object to a new subprocessor on reasonable data protection grounds within 15 days of the notice by writing to legal@voidhash.com. We will discuss your objection in good faith and may offer an alternative. If we cannot resolve it within 30 days, you may terminate the affected part of the Service before the new subprocessor starts processing your data and receive a pro-rata refund of prepaid fees (DPA section 9.5).
2.4 If a subprocessor must be replaced urgently (for example because of a security incident or the provider ending its service), we may do so immediately and notify you as soon as possible; your right to object applies from that notice.
3. Infrastructure subprocessors (all Customer Data)
These subprocessors host and operate the Service and may process all Customer Data, including Customer Personal Data about your End Users.
| Entity | Purpose | Data | Processing location | Transfer mechanism |
|---|---|---|---|---|
| Railway Corporation (USA) | Application hosting (API and background workers), Redis cache and queues | All Customer Data | USA — Virginia (us-east4) | EU–US DPF or SCCs (see section 7) |
| PlanetScale, Inc. (USA) | Primary PostgreSQL database | All Customer Data | USA — US East | EU–US DPF or SCCs (see section 7) |
| ClickHouse, Inc. (USA) — ClickHouse Cloud | Analytics event store | Events, persons, device and app context, IP addresses and IP-derived location | USA — AWS us-east-1 (Virginia) | EU–US DPF or SCCs (see section 7) |
| Cloudflare, Inc. (USA) | CDN, DNS, TLS, edge proxy and compute, real-time collaborative editing, R2 file storage, IP geolocation, DDoS protection | Request data (IP address, user agent, request contents), files and Customer Content | Global edge network for traffic; R2 file storage in the USA (eastern North America) | EU–US DPF or SCCs (see section 7) |
| Axiom, Inc. (USA) | Logs, traces and monitoring (30-day retention) | Technical logs and traces, which may contain identifiers and IP addresses | USA | EU–US DPF or SCCs (see section 7) |
4. Feature-specific subprocessors (AI)
These subprocessors process data only when you use the AI features.
| Entity | Purpose | Data | Processing location | Transfer mechanism |
|---|---|---|---|---|
| OpenAI, L.L.C. (USA) | Generating paywall content and assistant responses from your prompts and the content you provide | Prompts, instructions and content you submit to the AI features (for example paywall designs, product and pricing information, images); End User data only if you include it | USA | EU–US DPF or SCCs (see section 7) |
| Anthropic, PBC (USA) | Generating paywall content and assistant responses from your prompts and the content you provide | Prompts, instructions and content you submit to the AI features (for example paywall designs, product and pricing information, images); End User data only if you include it | USA | EU–US DPF or SCCs (see section 7) |
Voidhash does not use Customer Data, Customer Content or End User data to train artificial intelligence or machine-learning models, and does not permit its AI providers to do so. Our AI providers do not use this data to train their models.
5. Services Voidhash uses as controller for its own customers
The following providers process personal data about you as our customer (for example your team members' accounts, billing and support messages). Voidhash is the controller of that data under its Privacy Policy at https://voidhash.com/legal/privacy. These providers do not process End User data and are therefore not subprocessors under the DPA; we list them for transparency.
| Entity | Purpose | Data | Processing location | Transfer mechanism |
|---|---|---|---|---|
| WorkOS, Inc. (USA) | Sign-in, organisations, SSO/SAML/SCIM for dashboard users | Dashboard users' name, email, avatar, sign-in events, IP address | USA | EU–US DPF or SCCs (see section 7) |
| Autumn (useautumn.com) (USA) | Subscription billing and usage metering for Voidhash's own fees | Billing contact, plan, usage figures, Stripe customer identifiers | USA | EU–US DPF or SCCs (see section 7) |
| Stripe Payments Europe, Limited (Ireland) and Stripe, Inc. (USA) | Payment processing for Voidhash's own fees | Billing contact, payment method (card data is handled only by Stripe), invoices | EU and USA | EU–US DPF or SCCs (see section 7) |
| Slack Technologies, LLC (USA) | Internal routing of in-app feedback to the Voidhash team | Feedback message, sender's name and email, user agent, page path | USA | EU–US DPF or SCCs (see section 7) |
| Resend, Inc. (USA) | Sending service emails to account owners and admins (e.g. usage notices) | Name, email address, organization name, usage figures | USA | EU–US DPF or SCCs (see section 7) |
The infrastructure providers in section 3 also host Voidhash's own controller data.
6. Integrations you enable are not subprocessors
When you connect a third-party service with your own account or credentials, Voidhash sends data to it on your instruction. These providers act for you (or as independent controllers under their own terms with you), not as Voidhash subprocessors, and you are responsible for your agreement with them (DPA section 3.4). This includes in particular:
- Apple — App Store Server API and notifications, App Store Connect, Apple Push Notification service (APNs);
- Google — Google Play Developer API, Real-time developer notifications via Cloud Pub/Sub, Firebase Cloud Messaging (FCM);
- Stripe — your own Stripe account used for web purchases;
- Webhook endpoints you configure, and any services behind them;
- AI agents and tools you connect to Voidhash (for example through MCP);
- Third-party paywall components you install, to the extent they send data to endpoints chosen by their publisher.
7. International transfers
Our infrastructure subprocessors store and process data in the eastern United States. Transfers rely on the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 3) with supplementary measures, together with the UK Addendum and Swiss adjustments where applicable. See DPA section 14 and Annex IV.
8. Contact
Questions about this list: legal@voidhash.com.
9. Changelog
| Date | Change |
|---|---|
| 14 October 2026 | Version 1.0 — first publication of this list. |