--- title: Provider register (subprocessors) version: 2026-10-20.1 effectiveDate: null material: false summaryOfChanges: >- Google Fonts, the Tailwind CSS CDN, jsDelivr and unpkg are no longer independent providers: our home page, the editor and previews now serve their fonts and code libraries from our own servers. CodeSandbox's package service stays listed. No subprocessor was added or replaced. --- # TrueOwned provider register This register lists the providers that receive personal data when Lynx Group GmbH ("Lynx", "we") operates TrueOwned. It forms part of our [Privacy Notice](/privacy) and is Schedule 3 of the [Data Processing Agreement](/dpa) ("DPA"). We give at least 30 days' notice before adding or replacing an approved subprocessor (DPA Section 4). Earlier versions of this register remain available from this page. Transfer status was checked against the official Data Privacy Framework list () on 16 October 2026. "EU-US DPF" and "Swiss-US DPF" mean active certification under the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework; the European Commission's adequacy decision and Switzerland's recognition cover those certified transfers. "SCCs" means the European Commission's standard contractual clauses (Decision 2021/914), adapted for Swiss transfers as recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC), as included in the provider's data processing agreement. Switzerland and the EU/EEA recognise each other's data protection as adequate. ## 1. Approved subprocessors | # | Provider | What it does for TrueOwned | Personal data it receives | Where it processes data | Retention at the provider | Contract and transfer safeguard | |---|---|---|---|---|---|---| | 1 | **Hetzner Online GmbH**, Industriestr. 25, 91710 Gunzenhausen, Germany | Dedicated server in Falkenstein, Germany, running the TrueOwned application and background workers, the main PostgreSQL database and Emorise Login | All account, project, credit and support records in our database; site content; form submissions; server and access logs | Germany (Falkenstein). Administered remotely by Lynx from Switzerland | Controlled by Lynx (see the [Privacy Notice](/privacy), Section 8) | Hetzner data processing agreement under Art. 28 GDPR. No transfer outside the EU/EEA; Switzerland–Germany adequacy | | 2 | **Cloudflare, Inc.**, 101 Townsend St, San Francisco, CA 94107, USA | R2 object storage (site assets, private uploads, AI images, scroll-video media, database backups); Pages hosting and delivery of published sites; DNS; Turnstile bot protection on site forms; Email Routing for hello@trueowned.com | Files and media you upload or generate (which can show people); published site content; visitor IP addresses and request data for managed sites; backups of our database; emails sent to hello@trueowned.com while being forwarded | United States and Cloudflare's global network. R2 buckets use Cloudflare's standard (not EU-only) jurisdiction | R2: until we delete the object. Request logs: not retained by default. Email Routing: forwarded, not stored | Cloudflare Customer DPA (part of the self-serve subscription agreement). EU-US DPF and Swiss-US DPF active (re-certification under review); SCCs in the DPA as fallback | | 3 | **OpenRouter, Inc.**, New York, USA | Routes every AI text request (website copy, code, design, edits, logo SVG, image analysis) to the approved model endpoints below | Prompts, briefs, site content and images you send to an AI feature, and the responses | United States | No prompt logging; requests restricted to zero-data-retention endpoints with data collection denied (`zdr: true`, `data_collection: "deny"`); OpenRouter does not use inputs or outputs for training | OpenRouter DPA (incorporated into its terms for commercial customers). Not DPF-certified; SCCs (Module 2) with Swiss adaptations in the DPA | | 3a | → **Amazon Web Services, Inc.** (Amazon Bedrock), Seattle, USA | Runs Anthropic Claude 5.5 models for OpenRouter | As row 3 | United States or EU, as selected by OpenRouter; through a global (cross-region) endpoint, also other regions where Amazon Web Services operates | Zero data retention; no training | Subprocessor of OpenRouter under OpenRouter's terms. EU-US DPF and Swiss-US DPF active (Amazon.com, Inc.) | | 3b | → **Google LLC** (Google Cloud Vertex AI), Mountain View, USA | Runs Anthropic Claude 5.5 models for OpenRouter | As row 3 | United States or EU, as selected by OpenRouter; through Vertex AI's global endpoint, also other regions where Google Cloud operates | Zero data retention; no training | Subprocessor of OpenRouter under OpenRouter's terms. EU-US DPF and Swiss-US DPF active | | 4 | **fal – Features & Labels, Inc.**, San Francisco, USA | Generates AI images with FLUX.1 [schnell] on its own infrastructure (`fal-ai/flux/schnell`) | The image prompt (text) and the generated image | United States and other countries where fal operates | Request payload storage switched off (`X-Fal-Store-IO: 0`); fal's copy of each generated image deleted after 1 hour; we keep the image in our own storage. fal does not use client content for training | fal DPA (incorporated into its terms). Not DPF-certified; SCCs (Module 2) with Swiss modifications in the DPA | | 5 | **Modal Labs, Inc.**, New York, USA | Runs the GPU jobs that generate scroll videos (LTX-2.5, Wan 2.2 fallback) and transcode videos you upload | Your keyframe photographs, video instructions, uploaded videos and the generated video | United States | Function inputs and outputs up to 7 days; logs up to 30 days | Modal DPA (incorporated into its terms). Not DPF-certified; SCCs in the DPA with Swiss law for the Swiss clauses | | 6 | **Amazon Web Services EMEA SARL**, 38 Avenue John F. Kennedy, L-1855 Luxembourg (Amazon Simple Email Service) | Sends sign-in and verification emails for Emorise Login and form-submission notifications to site owners | Recipient email address; email content, including the fields a visitor submits in a site form | Germany (AWS region eu-central-1, Frankfurt); remote support access by Amazon Web Services, Inc. from the United States is possible | Email delivery records under AWS's standard retention | AWS DPA (incorporated into the AWS Service Terms). Transfers to Amazon Web Services, Inc.: EU-US DPF and Swiss-US DPF active (Amazon.com, Inc.); SCCs in the AWS DPA | | 7 | **Microsoft Ireland Operations Limited**, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (Microsoft 365) | Hosts the Lynx mailbox that receives hello@trueowned.com | Support and privacy enquiries, attachments and contact details | EU (Microsoft EU Data Boundary); remote support access by Microsoft Corporation from the United States is possible | Controlled by Lynx (24 months after an enquiry is closed) | Microsoft Products and Services DPA. Transfers to Microsoft Corporation: EU-US DPF and Swiss-US DPF active; SCCs in the DPA | | 8 | **Stripe Payments Europe, Limited**, 1 Grand Canal Street Lower, Dublin 2, Ireland, with Stripe, LLC (USA) | Processes subscription and top-up payments, invoices and the billing portal | Billing contact, business name and address, VAT number, payment method details (entered directly into Stripe), transactions | Ireland, United States and other countries where Stripe operates | Stripe's retention for payment and legal records | Stripe DPA and Data Transfers Addendum (incorporated into the Stripe Services Agreement). Stripe, LLC: EU-US DPF and Swiss-US DPF active. Stripe acts as an independent controller for fraud prevention and its regulatory duties (Section 2) | ## 2. Independent controllers and services you choose These providers are not our subprocessors. They decide for themselves how they use the data they receive, under their own privacy policies. | Provider | When it receives data | Data | Country and safeguard | |---|---|---|---| | **Stripe** (for fraud prevention, anti-money-laundering and its other legal duties) | Whenever you pay, and when you open the settings pages, which load Stripe's payment script | Payment, device and transaction data | As row 8 | | **GitHub, Inc.**, San Francisco, USA | When you connect your GitHub account and export or publish a site to your repository | Your GitHub identity, the authorisation token you grant (stored encrypted by us), the exported site code and commit details. Public repositories are visible to everyone | United States; EU-US DPF and Swiss-US DPF active. Your own GitHub terms apply | | **Google LLC**, **Microsoft Corporation**, **GitHub, Inc.** as sign-in providers | When you choose "Sign in with Google", "Sign in with Microsoft" or "Sign in with GitHub" | Your name, email address and account identifier at that provider | United States; EU-US DPF and Swiss-US DPF active for all three | | **Unsplash Inc.**, Montreal, Canada | When the Service searches for stock photographs, when a photograph is placed in a site, and whenever a visitor loads a page that shows an Unsplash photograph (the image is loaded directly from Unsplash, as Unsplash's API terms require) | Search terms derived from your brief (sent from our server); a download notification without visitor data; for page visitors: IP address, browser details and the page address (referrer) | Canada, with images delivered through a global content delivery network. Canada has an EU and Swiss adequacy decision for commercial organisations; Unsplash has no DPF certification. Each photograph shows a visible "Photo by … on Unsplash" credit with links to the photographer's Unsplash profile and to Unsplash | | **Your own model provider** | Only if your account uses its own OpenAI or Anthropic API key, a feature that is off unless we enable it for you | The AI requests made with that key | Under your own contract with that provider | | **CodeSandbox** (package service and load-time measurement) | When the live editor's preview loads the open-source code packages it runs and reports its load times | IP address, browser details, the names and versions of the requested packages, and the preview's load times with your browser's user agent; no project content | Global content delivery network; CodeSandbox's package service runs on Amazon Web Services in Ireland. We have no data processing agreement with this provider | ## 3. Internal functions **Emorise Login** (login.emorise.com) is the sign-in service of Lynx Group GmbH. It runs on our own server at Hetzner in Germany (row 1) using self-hosted Logto software, and the same Lynx login is used for TrueOwned and other Lynx (Emorise) products. It is not a separate recipient: Lynx operates it as part of TrueOwned. It stores your name, email address, linked sign-in providers, sessions and sign-in logs. The Logto software vendor receives no personal data from it. ## 4. Not recipients The following are named in our model schedules but receive no personal data from TrueOwned: - **Lightricks Ltd.** (LTX-2.5), **Alibaba / Wan team** (Wan 2.2) and **Google** (the Gemma 4 text encoder inside LTX-2.5): we run these models ourselves on Modal (row 5); the model authors receive nothing. - **Black Forest Labs** (FLUX.1 [schnell]): the model runs at fal (row 4). - **Anthropic** (Claude 5.5): requests are served by Amazon Bedrock or Google Vertex AI (rows 3a and 3b), not by Anthropic's own API. - **Hugging Face, Inc.**: we download model weights from it; no customer data is sent. - **Google Fonts, the Tailwind CSS CDN, jsDelivr and unpkg**: published sites, exports, our home page, the editor and previews use font files and code libraries served by us or by the site's own host; browsers do not contact these providers. Our server downloads the public files from them without any personal data. - We use **no analytics, advertising or error-tracking service**.