01
Current sub-processors
These companies process our customers' data on behalf of AltOwl. The list is Annex 2 of the Data Processing Agreement and is incorporated there by reference.
| Company | Purpose | Data | Location / transfer basis |
|---|---|---|---|
|
Hetzner Online GmbH Industriestr. 25, 91710 Gunzenhausen, Deutschland Privacy notice ↗ |
Hosting / infrastructure | All platform data (servers, database, backups) | Deutschland EU |
|
Google Ireland Limited (Gemini API, Google Cloud) Gordon House, Barrow Street, Dublin 4, Irland — Verarbeitung durch Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA Privacy notice ↗ |
AI image description
Primary AI provider |
Image data (transmitted as image file) and the description prompt; no customer identifiers |
Irland / USA
Third country EU-US Data Privacy Framework adequacy decision (Google LLC is certified) and EU Standard Contractual Clauses |
|
OpenAI, L.L.C. 3180 18th Street, San Francisco, CA 94110, USA Privacy notice ↗ |
AI image description
AI provider (fallback) |
Image URL or image file and the description prompt; no customer identifiers |
USA
Third country EU-US Data Privacy Framework adequacy decision (OpenAI is certified) and EU Standard Contractual Clauses |
|
Anthropic, PBC 548 Market St, PMB 90375, San Francisco, CA 94104, USA Privacy notice ↗ |
AI image description
AI provider (fallback) |
Image URL or image file and the description prompt; no customer identifiers |
USA
Third country EU-US Data Privacy Framework adequacy decision (Anthropic is certified) and EU Standard Contractual Clauses |
|
Stripe Payments Europe, Ltd. 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Irland — Verarbeitung auch durch Stripe, Inc., 354 Oyster Point Blvd, South San Francisco, CA 94080, USA Privacy notice ↗ |
Payment processing | Payment data (name, email, billing address, payment method); no image data |
Irland / USA
Third country EU-US Data Privacy Framework adequacy decision (Stripe, Inc. is certified) and EU Standard Contractual Clauses |
02
Changes
Before we engage a new sub-processor or replace an existing one, we notify all customers at least 30 days in advance by email to the address stored in the user account. Within this period customers may object for a substantial data protection reason (§ 6 DPA).
- List as of: 2026-09-18
03
AI providers in detail
AltOwl uses several AI providers and automatically selects one per job. For each provider:
- What is transmitted: the image (as URL or file) and the description prompt. No customer identifier, no account data, no information about the website – unless apparent from the image URL itself.
- No training: we use only the paid API tiers whose terms exclude the use of inputs for model training.
- Retention by the provider: according to the providers, inputs are retained only for abuse monitoring for a limited period (typically up to 30 days) and then deleted.
- Traceability: which provider handled a job is logged and can be disclosed on request.