Legal

Subprocessors

Last updated: 30 October 2026

The third parties Sightova engages to help run the Service, what each one does, where it processes data, and how we notify you before anything changes.

Overview

A subprocessor is a third party that processes personal data on behalf of Medienor AS in order to deliver the Sightova Service, as described in our Data Processing Addendum. We keep this list deliberately short: the application, database and detection models all run on a single EU hosting provider, and images are never sent to any third party for analysis.

9

subprocessors in total

2

process data only in the EU

0

receive images for analysis

Current Subprocessors

Each provider is engaged under its own written data-protection terms.

Hetzner Online

Hetzner Online GmbH

Nuremberg, Germany (EU)Privacy policy
Purpose
Cloud hosting for the application, database, detection models and transient image processing.
Data processed
All Service data: account records, hashed credentials, API keys (hashed), analysis logs, request metadata (IP, user-agent), images while they are being analysed.
When
Always — this is where the Service runs.
Transfer safeguard
None — processed and stored in the EU.

Cloudflare

Cloudflare, Inc.

United States (global edge network)Privacy policy
Purpose
Receives web and API traffic, terminates TLS at its edge and forwards it through an encrypted tunnel to our server. Also provides DNS.
Data processed
All web and API traffic in transit, including uploaded images, IP addresses and request headers.
When
On every request to sightova.com, since 23 October 2026.
Transfer safeguard
Cloudflare's Data Processing Addendum, including the EU Standard Contractual Clauses.

Microsoft Clarity

Microsoft Corporation

United StatesPrivacy policy
Purpose
Website and dashboard analytics, including session recordings.
Data processed
Clicks, scrolling, device and usage data, and what is shown on screen, which can include images shown in the dashboard.
When
When statistics cookies are on. Visitors from the EEA, UK and Switzerland opt in; elsewhere they are on by default and can be switched off.
Transfer safeguard
Microsoft's data protection terms, including the EU Standard Contractual Clauses.

OpenStreetMap Nominatim

OpenStreetMap Foundation

United KingdomPrivacy policy
Purpose
Looks up a place name for images that contain GPS metadata.
Data processed
The GPS coordinates from the image's metadata, sent from our server. No image or account details.
When
Only when a scanned image contains GPS metadata.
Transfer safeguard
The United Kingdom has an EU adequacy decision.

Stripe

Stripe Payments Europe, Ltd. / Stripe, Inc.

Ireland (EU) / United StatesPrivacy policy
Purpose
Subscription billing, card processing, invoices and the customer billing portal.
Data processed
Name, email, billing address, payment card details (never touch our servers), plan and subscription identifiers.
When
When a customer upgrades to a paid plan or manages billing.
Transfer safeguard
EU Standard Contractual Clauses and Stripe's Data Privacy Framework certification.

Google (Sign in with Google)

Google Ireland Limited / Google LLC

Ireland (EU) / United StatesPrivacy policy
Purpose
Optional OAuth sign-in.
Data processed
Google account ID, email address, display name and profile picture URL — only for users who choose to sign in with Google.
When
Only when a user authenticates with Google.
Transfer safeguard
EU Standard Contractual Clauses and Google's Data Privacy Framework certification.

Mailjet

Mailjet SAS (a Sinch company)

Paris, France (EU)Privacy policy
Purpose
Transactional email: account verification, password reset and account notices.
Data processed
Recipient email address and name, one-time verification / reset codes.
When
When an account email is sent.
Transfer safeguard
None — processed in the EU.

RapidAPI

Rapid API, Inc.

United StatesPrivacy policy
Purpose
API marketplace gateway for customers who subscribe to Sightova through RapidAPI instead of directly.
Data processed
RapidAPI username and plan, request metadata, and the submitted image in transit through the gateway.
When
Only for customers who purchase via the RapidAPI marketplace.
Transfer safeguard
RapidAPI's own terms and Data Processing Addendum govern the gateway leg; customers contract with RapidAPI directly.

Telegram

Telegram FZ-LLC

Dubai, UAEPrivacy policy
Purpose
Internal operational alerts to the Sightova team (new sign-ups, contact-form submissions, subscription changes, error alerts).
Data processed
Name, email address, company and message text from the contact form; email address on sign-up, sign-in and subscription events; RapidAPI username on marketplace events; error messages (no customer content).
When
When one of those events occurs.
Transfer safeguard
No EU adequacy decision for the UAE. Alerts contain only the minimum fields the team needs to respond; no images or analysis results are ever sent.

Tools That Are Not Subprocessors

Security reviews often ask about these. They are part of how we build or run Sightova but they do not receive personal data, so they are not subprocessors under the GDPR.

  • MaxMind GeoLite2. IP-to-country database bundled with the application and queried offline on our own server. No IP addresses are sent to MaxMind.
  • Let's Encrypt. Issues our TLS certificates. Receives only the sightova.com domain name.
  • GitHub. Hosts our source code. No customer data, credentials or databases are stored in the repository.
  • Google Fonts. Font files are downloaded at build time and served from our own server; visitors' browsers never contact Google.
  • Detection models. Our AI detection models run on our own Hetzner infrastructure. Images are never sent to OpenAI, Replicate, Hugging Face or any other third-party inference API.

Changes & Objections

We update this page whenever we add, replace or remove a subprocessor. For additions and replacements we publish the change here at least 30 days before the new provider starts processing personal data, and we email the account owners of paying customers who have asked to be notified.

To subscribe to change notifications, email [email protected] with the subject "Subprocessor notifications" from the address on your account.

Right to object

If you have a reasonable, documented data-protection objection to a new subprocessor, tell us within the 30-day notice period. We will work with you in good faith on an alternative; if none is possible, you may terminate the affected Service and receive a pro-rata refund of prepaid fees, as set out in Section 6 of the DPA.

Change Log

30 October 2026Added Cloudflare (in use since 23 October 2026), Microsoft Clarity and OpenStreetMap Nominatim to this list.
15 September 2026Initial publication of the subprocessor list.