Sub-processor List
Last updated: 12-Apr-2026
1. Introduction
This document lists the sub-processors (subcontractors) that DoLoop GmbH ("DoLoop," "we," "us") engages to process personal data and Customer Data on our behalf in connection with the DoLoop Service.
This Sub-processor List is incorporated by reference into our Terms and Conditions and Privacy Policy.
2. Changes to This List
We may update this Sub-processor List from time to time as we engage new sub-processors or change existing ones. When we make material changes to this list, we will notify customers without undue delay via email to the address associated with their account.
Your continued use of the Service following notification of changes constitutes acceptance of the updated Sub-processor List. If you do not agree to a material change, you may exercise your right to extraordinary termination of your Subscription in accordance with Section 5 below.
3. Current Sub-processors
3.1 Infrastructure and Hosting (EU)
| Sub-processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Supabase, Inc. | Database services (PostgreSQL) | Account data, Service usage data | EU (Frankfurt) |
| Upstash, Inc. | Database services (Redis caching) | Session data, cached queries | EU (Frankfurt) |
| Amazon Web Services EMEA SARL | File storage and backups (S3) | Uploaded documents, backups | EU (Frankfurt) |
| Temporal Technologies, Inc. | Durable workflow orchestration | Workflow state, task data | EU (Frankfurt) |
| Fly.io, Inc. | Application hosting | All Service data in transit | EU (Frankfurt) |
| Vercel, Inc. | Application hosting and edge functions | All Service data in transit | EU (Frankfurt) |
3.2 Communications (EU)
| Sub-processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Resend, Inc. | Transactional email delivery | Email address, name | EU |
3.3 AI and LLM Services (Global)
| Sub-processor | Purpose | Data Processed | Location |
|---|---|---|---|
| OpenRouter, Inc. | LLM API gateway | Prompts containing user content | Global |
| OpenAI, LLC | LLM provider | Prompts containing user content | Global |
| Anthropic, PBC | LLM provider | Prompts containing user content | Global |
| Google LLC | LLM provider | Prompts containing user content | Global |
| Amazon Web Services, Inc. | LLM hosting (Bedrock) | Prompts containing user content | Global |
| Google Cloud Platform | LLM hosting (Vertex AI) | Prompts containing user content | Global |
| Microsoft Corporation | LLM hosting (Azure OpenAI) | Prompts containing user content | Global |
Note on AI/LLM Processing:
- We use OpenRouter as an API gateway to route requests to large language models from OpenAI, Anthropic, and Google
- Models may be accessed directly from native providers or via cloud-hosted versions on AWS Bedrock, Google Cloud Vertex AI, and Microsoft Azure OpenAI Service
- OpenRouter is configured with prompt/completion logging disabled by default
- Under their standard API terms of service, the LLM providers do not use your data to train their models
- Prompts are processed to generate responses and are subject only to limited retention for abuse monitoring and safety purposes (typically 30 days or less, depending on the provider)
3.4 Document Processing (EU / Global)
| Sub-processor | Purpose | Data Processed | Location |
|---|---|---|---|
| CloudConvert GmbH | Office document conversion to PDF | Uploaded documents | EU (Frankfurt) |
| Datalab, Inc. | Document extraction and processing | Uploaded documents | Global |
| Firecrawl, Inc. | URL retrieval and markdown extraction | Submitted page URLs, retrieved page content | Global |
| AssemblyAI, Inc. | Audio and video transcription | Uploaded audio and video files | Global |
| Exa Labs, Inc. | Web search for market and competitive research | System-generated search queries (no Personal Data or Customer Data) | USA |
Note on Document Processing:
- CloudConvert: Office documents (e.g., Word, Excel, PowerPoint) are converted to PDF within the EU (Frankfurt, Germany). Files are deleted immediately upon completion of conversion. CloudConvert GmbH is a German company subject to GDPR.
- Datalab: Documents are deleted immediately upon completion of processing. Extracted response data is cached for a maximum of 4 hours, then deleted. Only non-personal metadata (document title, page count) is retained thereafter.
- Firecrawl: URL-backed document imports and web content retrieval features submit the target URL to Firecrawl so the referenced page can be fetched and converted into markdown for use within the Service. Only publicly available web content is retrieved.
- AssemblyAI: Uploaded audio and video files are transcribed to text. Files are processed and deleted upon completion of transcription. AssemblyAI does not use customer data to train its models.
- Exa: Market and competitive research queries are system-generated by DoLoop and contain no Personal Data or Customer Data. Only generalized search terms (such as market categories, industry terms, or competitor names) are transmitted. Exa may use these system-generated queries to improve its own services.
3.5 Observability and Analytics (EU)
| Sub-processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Dash0 | Essential operational telemetry and application performance monitoring | Technical data, error logs | EU (Belgium) |
| PostHog, Inc. | Product analytics and session replay | Usage data, session recordings | EU (Frankfurt) |
3.6 Payments and Subscriptions (USA)
| Sub-processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Polar Software, Inc. | Subscription and payment management | Payment data, email, name | USA |
Note on Payment Processing:
- Data limited to: name, email address, payment method details, subscription status
4. International Data Transfers
The majority of personal data is processed within the European Union. For sub-processors located outside the EU (marked as "Global" or "USA" above), we rely on the data processing agreements and privacy frameworks incorporated into each provider's standard terms of service, which include their commitments to handle personal data in accordance with applicable data protection laws.
We select providers who demonstrate commitment to data protection and who implement appropriate technical and organizational measures to protect personal data.
5. Your Rights Regarding Sub-processor Changes
You do not have a right to reject individual sub-processor changes. However, if you reasonably determine that a material change to this Sub-processor List adversely affects the protection of your data, you may exercise your right to extraordinary termination of your Subscription by providing written notice to us within thirty (30) days of receiving notification of the change.
Upon such termination:
- Your Subscription will end effective immediately or at a date you specify within the notice period
- We will provide a pro-rata refund of any prepaid fees for the unused portion of your Subscription term
- You may request an export of your data prior to termination
To exercise this right, contact us at info@doloop.cc.
6. Contact
If you have questions about this Sub-processor List or our data processing practices, please contact us:
DoLoop GmbH
Email: info@doloop.cc
Address: [ADDRESS]
This Sub-processor List is effective as of 12-Apr-2026.