Legal

Subprocessors

Last updated: 15 September 2026

The third parties Sightova engages to help run the Service, what each one does, where it processes data, and how we notify you before anything changes.

Overview

A subprocessor is a third party that processes personal data on behalf of Medienor AS in order to deliver the Sightova Service, as described in our Data Processing Addendum. We keep this list deliberately short: the application, database and detection models all run on a single EU hosting provider, and images are never sent to any third party for analysis.

6

subprocessors in total

2

process data only in the EU

0

receive images for analysis

Current Subprocessors

Each provider is engaged under a written agreement with data-protection and security obligations at least as protective as our DPA, and is used only to provide the Service.

Hetzner Online

Hetzner Online GmbH

Nuremberg, Germany (EU)Privacy policy
Purpose
Cloud hosting for the application, database, detection models and transient image processing.
Data processed
All Service data: account records, hashed credentials, API keys (hashed), analysis logs, request metadata (IP, user-agent), images while they are being analysed.
When
Always — this is where the Service runs.
Transfer safeguard
None — processed and stored in the EU.

Stripe

Stripe Payments Europe, Ltd. / Stripe, Inc.

Ireland (EU) / United StatesPrivacy policy
Purpose
Subscription billing, card processing, invoices and the customer billing portal.
Data processed
Name, email, billing address, payment card details (never touch our servers), plan and subscription identifiers.
When
When a customer upgrades to a paid plan or manages billing.
Transfer safeguard
EU Standard Contractual Clauses and Stripe's Data Privacy Framework certification.

Google (Sign in with Google)

Google Ireland Limited / Google LLC

Ireland (EU) / United StatesPrivacy policy
Purpose
Optional OAuth sign-in.
Data processed
Google account ID, email address, display name and profile picture URL — only for users who choose to sign in with Google.
When
Only when a user authenticates with Google.
Transfer safeguard
EU Standard Contractual Clauses and Google's Data Privacy Framework certification.

Mailjet

Mailjet SAS (a Sinch company)

Paris, France (EU)Privacy policy
Purpose
Transactional email: account verification, password reset and account notices.
Data processed
Recipient email address and name, one-time verification / reset codes.
When
When an account email is sent.
Transfer safeguard
None — processed in the EU.

RapidAPI

Rapid API, Inc.

United StatesPrivacy policy
Purpose
API marketplace gateway for customers who subscribe to Sightova through RapidAPI instead of directly.
Data processed
RapidAPI username and plan, request metadata, and the submitted image in transit through the gateway.
When
Only for customers who purchase via the RapidAPI marketplace.
Transfer safeguard
RapidAPI's own terms and Data Processing Addendum govern the gateway leg; customers contract with RapidAPI directly.

Telegram

Telegram FZ-LLC

Dubai, UAEPrivacy policy
Purpose
Internal operational alerts to the Sightova team (new sign-ups, contact-form submissions, subscription changes, error alerts).
Data processed
Name, email address, company and message text from the contact form; email address on sign-up, sign-in and subscription events; RapidAPI username on marketplace events; error messages (no customer content).
When
When one of those events occurs.
Transfer safeguard
No EU adequacy decision for the UAE. Alerts contain only the minimum fields the team needs to respond; no images or analysis results are ever sent.

Tools That Are Not Subprocessors

Security reviews often ask about these. They are part of how we build or run Sightova but they do not receive personal data, so they are not subprocessors under the GDPR.

  • MaxMind GeoLite2. IP-to-country database bundled with the application and queried offline on our own server. No IP addresses are sent to MaxMind.
  • Let's Encrypt. Issues our TLS certificates. Receives only the sightova.com domain name.
  • GitHub. Hosts our source code. No customer data, credentials or databases are stored in the repository.
  • Google Fonts. Font files are downloaded at build time and served from our own server; visitors' browsers never contact Google.
  • Detection models. Our AI detection models run on our own Hetzner infrastructure. Images are never sent to OpenAI, Replicate, Hugging Face or any other third-party inference API.

Changes & Objections

We update this page whenever we add, replace or remove a subprocessor. For additions and replacements we publish the change here at least 30 days before the new provider starts processing personal data, and we email the account owners of paying customers who have asked to be notified.

To subscribe to change notifications, email hello@sightova.com with the subject "Subprocessor notifications" from the address on your account.

Right to object

If you have a reasonable, documented data-protection objection to a new subprocessor, tell us within the 30-day notice period. We will work with you in good faith on an alternative; if none is possible, you may terminate the affected Service and receive a pro-rata refund of prepaid fees, as set out in Section 6 of the DPA.

Change Log

15 September 2026Initial publication of the subprocessor list.