Legal
Sub-processors
The providers that process personal data on our behalf. The list is dated so that a change to it is visible.
In short
- We will add a provider to this list before it starts processing, not after.
- There is no CRM, no advertising network, no data enrichment provider, no error-tracking SaaS, and no marketing automation platform.
These are sentences from the text below; they do not replace it, and the full text governs.
Effective 14 October 2026. This list is dated so that a change to it is visible rather than announced.
These are the providers that process personal data on our behalf. EUR-Lex regulation texts are public records; we do not send them to a processor for storage beyond our own host.
| Provider | What it does | Where it runs | Outside the EEA |
|---|---|---|---|
| Hetzner Online GmbH | Hosting. The MCP application, the corpus database, the trial and account records and our web server’s access log run on one virtual machine; the encrypted backups are kept on Hetzner storage | Germany | No |
| Resend, Inc. | Sends the sign-in email, the account-deletion confirmation, and the feedback and messages you send us, forwarded to our team | Sent from its EU region (Ireland); a company in the United States | Yes: see the note below |
| Cloudflare, Inc. | DNS, TLS termination and caching proxy in front of rekvira.com and mcp.rekvira.com, and forwarding of messages sent to our addresses | Cloudflare’s global network; a request is usually handled in a data centre near the visitor | Yes, standard contractual clauses |
| Google (Google Workspace) | The mailbox where messages sent to our addresses arrive | Data may be processed in the United States and other countries | Yes: the EU-U.S. Data Privacy Framework and the EU standard contractual clauses, under Google’s data processing terms |
What is deliberately absent
There is no CRM, no advertising network, no data enrichment provider, no error-tracking SaaS, and no marketing automation platform. Email goes out only when you ask to sign in or to delete your account; Rekvira sends no newsletters or marketing email.
Note on Resend. Resend is a United States company, so sending a sign-in email is a transfer outside the EEA. Sign-in by email is on for everyone: since 14 October 2026 every request needs an account. The transfer relies on the EU standard contractual clauses in Resend’s data processing terms; Resend also states that it complies with the EU-U.S. Data Privacy Framework.
Changes
We will add a provider to this list before it starts processing, not after. Material changes are announced on this page with the date of the change, rather than by quietly replacing it.