--- title: "Review subprocessors and transfer safeguards" description: "Lists Duale AI subprocessors, the personal data they process, locations, transfer safeguards, notice periods for EEA and non‑EEA changes, and contact details for objections." lang: en lastUpdated: 2026-05-28 url: https://dev.duale.ai/en/legal/subprocessors --- ## AI-generated summary Provides a detailed list of Duale AI subprocessors that may handle personal data, outlines notice periods for changes, describes international transfer safeguards, and clarifies the roles of hosting, CDN, payment, support, and AI processing services, plus contact options. - The page lists all Duale AI subprocessors, their services, personal data processed, processing locations, and applicable transfer safeguards. - Customers receive email notice 30 days before EEA‑based subprocessor changes and 90 days before non‑EEA changes, with an objection address provided. - Hosting and authentication run on Hetzner infrastructure in Germany, while Cloudflare provides CDN services under the EU‑US Data Privacy Framework or SCCs. - Stripe processes payment data from Ireland and the United States with the EU‑US Data Privacy Framework or SCCs; Duale AI does not store credit‑card numbers. - Support chat is handled by Crisp IM SAS within the EEA, and the company states it does not use any third‑party analytics that collect personal data. Summaries were generated by AI. Generative AI is experimental. --- ## Introduction List of subprocessors that may process personal data to provide, host, or secure Duale AI services. ## Changes Duale AI notifies Customers by email before any addition or replacement: - **30 days** prior notice for European Economic Area-based subprocessors - **90 days** prior notice for subprocessors outside the European Economic Area Objections: [.ai](mailto:) ## International Transfers Transfers outside the European Economic Area rely on the Data Privacy Framework where it applies, or on the 2021 standard contractual clauses with supplementary measures where required. --- ## Infrastructure, Hosting and Network Security | Subprocessor | Service Provided | Personal Data Concerned | Processing Location | Transfer Safeguards | | ------------------- | -------------------------------------------------------- | -------------------------------------------------------------------------------------- | ------------------------------- | --------------------------------------------------------------------------------------------------------------------- | | Hetzner Online GmbH | Hosting of Duale AI application infrastructure | Account, authentication and usage data, content needed for the service, technical logs | Germany, European Economic Area | No transfer outside the European Economic Area for this processing | | Cloudflare, Inc. | Website hosting, content delivery and network protection | IP address, user agent, URL, request headers, traffic metadata, security logs | Cloudflare global network | Data Privacy Framework where it applies; 2021 standard contractual clauses with supplementary measures where required | ## Authentication Authentication is operated internally on Hetzner infrastructure in Germany. No external identity provider is used. ## Artificial Intelligence Services Customer chooses and contracts directly with model providers. These providers are not subprocessors imposed by Duale AI. Duale AI internally processes routing and contextual memory on Hetzner infrastructure in Germany. Data is not reused outside the Customer context, for training, or for statistics. ## Payment and Billing | Subprocessor | Service Provided | Personal Data Concerned | Processing Location | Transfer Safeguards | | ---------------------------- | ------------------ | --------------------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | | Stripe Payments Europe, Ltd. | Payment processing | Banking data, email address | Ireland / United States | European Union-United States Data Privacy Framework where applicable; 2021 standard contractual clauses and supplementary measures where required | **Note:** Duale AI does not store credit card numbers. ## Communication and Support | Subprocessor | Service Provided | Personal Data Concerned | Processing Location | Transfer Safeguards | | ------------ | ---------------------- | --------------------------- | ---------------------- | -------------------------------------------------------- | | Crisp IM SAS | Customer support, chat | Email, name, ticket content | European Economic Area | No transfer outside the European Economic Area indicated | ## Analytics and Monitoring Duale AI does not use third-party analytics or monitoring services that collect personal data. ## Contact - **Questions:** [.ai](mailto:) - **Data processing agreement request:** [.ai](mailto:) ## Related content - [Privacy policy governing data collection and use](https://dev.duale.ai/en/legal/privacy.md) - [Review security posture for production AI agents](https://dev.duale.ai/en/product/security.md) - [Legal terms and conditions for SaaS platform and credits](https://dev.duale.ai/en/legal/cgv.md) - [Govern AI agents with shared operating model for compliance](https://dev.duale.ai/en/solutions/governance.md) - [Terms of Use for AI Agent Platform Services](https://dev.duale.ai/en/legal/cgu.md) - [Deploy durable AI agents with stable contracts and routing](https://dev.duale.ai/en/home.md) --- ## Sitemap See the full [Markdown sitemap](https://dev.duale.ai/sitemap.md) for all pages.