Providers and subprocessors

This list distinguishes entrusted project data from the Operator’s own processing and independent controllers. Actual scope depends on enabled services. Before adoption as a DPA annex, confirm: full contracting entities, countries, regions, transfer mechanisms and active service variants. Code integration alone does not confirm production settings.

1. Infrastructure

Cloudflare: traffic handling, private photo/file storage in R2 and processing functions in Workers. Depending on the operation it receives project content, metadata and technical data. It is a subprocessor for entrusted data; the relevant contract governs the Operator’s own data. An R2 location preference does not guarantee EU-only processing. Regions, support access and Worker content logging require account and contract verification. The current OpenAI code path does not use AI Gateway. Cloudflare DPA.

Railway: application, API and database hosting, including account and project data. Subprocessor for entrusted data. A service region does not determine every place of access and processing; production settings read on 2 November 2026 confirm Europe West (europe-west4-drams3a) for applications/databases and Amsterdam (ams) for Railway buckets. This does not confirm EEA-only processing. Transfer safeguards must be mapped to the relevant agreement. Railway DPA.

2. AI analysis

OpenAI: the current provider for analysis of images, text and context and generation of suggestions. It acts as a subprocessor of entrusted content within the API services. The standard DPA identifies OpenAI Ireland Ltd. for customers in the EEA and Switzerland; confirm the entity and conditions applicable to the Struvo account against its agreement. The current integration code calls OpenAI Responses API directly from a Cloudflare Worker with response storage disabled through store: false. This does not establish European residency or zero retention. Project region, data-sharing settings, retention and transfer mechanism require confirmation. OpenAI DPA, AI and data.

Google Gemini, Alibaba Qwen and OpenRouter are not listed as current AI providers. Enabling them requires an updated list and compliance with the DPA subprocessor-change procedure first.

3. Messaging

Resend, a service of Plus Five Five, Inc.: transactional emails, invitations and notifications. Data includes recipient addresses, message contents and delivery metadata; project messages may include entrusted data. In this scope the provider acts as processor/subprocessor. For struvo.pl, the 2 November 2026 account read confirms sending region eu-west-1 with Resend open/click tracking disabled. This does not establish every processing location; retention and transfer bases need account-specific confirmation. Resend privacy policy, Resend DPA.

4. Payments

Stripe: subscriptions and payments, payer/billing details and transaction identifiers. Depending on the operation, Stripe may be processor or independent controller for its own payment, regulatory and anti-abuse duties. The whole payment service is not classified as a subprocessor of construction documentation. Confirm the contracting entity, regions and transfer bases in the account agreement. Stripe privacy, Stripe DPA.

5. Optional analytics

PostHog: web usage analytics and error diagnostics after consent. Data may include events, errors, identifiers and the signed-in user’s name, email and role. These are not exclusively anonymous statistics. The Operator is controller for this analytics; this does not automatically make the provider a subprocessor of all project data. The project linked to www.struvo.pl and app.struvo.pl, read on 2 November 2026, confirms a European ingestion endpoint. Event/error retention and the binding agreement still require confirmation; recording retention is a separate setting. PostHog privacy, PostHog DPA.

6. Changes and contact

Changes affecting entrusted-data subprocessors follow the DPA notice and objection procedure. Request transfer safeguard information through privacy@struvo.pl. A new integration cannot receive data merely because its code exists: it requires role assessment, an agreement and an appropriate list entry.