Skip to main content

    Subprocessors / Third-Party Processors

    Version / last updated: 4 Jun 2026

    Scope & transparency model

    This page lists the third-party processors used by KROMA UG (haftungsbeschränkt) to operate Flyzle and related services, together with their purpose, processing region and transfer mechanism for data leaving the EU/EEA.

    Material changes (new processor, new region, change of transfer mechanism) are announced at least 14 days in advance via email to billing contacts where required by contract, giving the right to object under Art. 28(2) GDPR.

    Infrastructure & platform

    • Supabase (managed Postgres, auth, object storage, edge functions, via Lovable Cloud) — EU region (Frankfurt / Ireland) — DPA + SCC.
    • Cloudflare, Inc. (CDN, DNS, edge caching, WAF, Turnstile bot protection) — global edge — DPA + SCC.
    • Lovable (application hosting and edge delivery for flyzle.com) — primary data residency in the EU; global edge endpoints (Cloudflare) may serve static assets from the user's nearest region — DPA + SCC.

    Billing & email

    • Polar Software, Inc. (Merchant of Record, checkout, subscription management, customer portal, billing webhooks) — US — DPA + SCC + EU-US Data Privacy Framework; full card data never reaches our servers.
    • Resend (transactional email — authentication, billing receipts, alerts, digests) — US — DPA + SCC.

    AI generation

    All AI providers below are bound by enterprise / API terms that contractually prohibit training their foundation models on your prompts, brand data or outputs.

    • Google LLC — Gemini API (text, image, video generation) — US — DPA + SCC + DPF.
    • OpenAI, L.L.C. (legacy AI generation paths) — US — DPA + SCC + DPF.
    • Anthropic PBC (Claude API, used selectively) — US — DPA + SCC.
    • ElevenLabs Inc. (text-to-speech for video) — US — DPA + SCC.
    • HeyGen Labs Inc. (AI avatar video generation) — US — DPA + SCC.
    • Creatomate B.V. (MP4 rendering pipeline) — Netherlands / EU — DPA in place.
    • Replicate Inc. (selective image/video model inference) — US — DPA + SCC.

    Research & SERP data

    Used during business analysis. No end-user PII is sent — only public URLs and search queries derived from your brief.

    • Perplexity AI Inc. — US — DPA + SCC.
    • DataForSEO LLC — US — DPA + SCC.
    • Firecrawl Inc. — US — DPA + SCC.

    Publishing fan-out

    • Zernio, Late, Upload-Post (scheduled cross-platform publishing) — only the social content and credentials you explicitly connect are shared — DPA in place.
    • Social and messaging platforms you explicitly connect (LinkedIn, Instagram, Facebook, TikTok, YouTube, Threads, X, Telegram, Discord, Pinterest, Reddit, Bluesky, Mastodon, Dev.to, Hashnode, Ghost and others) — independent controllers under their own terms.

    Product analytics

    Loaded only after the visitor accepts the analytics cookie category. No advertising, no cross-site tracking, no session recording, no sale of data.

    • PostHog (EU Cloud, eu.i.posthog.com) — acquisition funnel analytics (landing → signup → strategy → checkout → subscription). Pseudonymous device ID, Flyzle user ID, event names, UTM/referrer, page path. Autocapture and session recording disabled — EU — DPA + SCC.

    Observability

    • Sentry (Functional Software, Inc.) — privacy-hardened error monitoring with sendDefaultPii=false, masked input/text replays, stripped Authorization headers, cookies and OAuth tokens — EU region — DPA + SCC.
    • Datadog, Inc. — server-side logs, metrics and traces; browser RUM is currently inactive in the shipped app — EU region (datadoghq.eu) — DPA + SCC.
    • GitHub, Inc. (release-note automation, optional) — US — DPA + SCC.

    Stock media

    • Pexels GmbH — royalty-free stock photo/video search & download for AI-generated videos and posts. Only the derived search query is sent; no end-user PII. Pexels License: https://www.pexels.com/license/ — EU/US (CDN) — SCC where applicable.

    International transfers

    Where personal data is transferred outside the EU/EEA, transfers rely on an adequacy decision (EU-US Data Privacy Framework where the recipient is certified), the EU Standard Contractual Clauses (Commission Implementing Decision 2021/914), or another lawful Art. 46 GDPR mechanism, supplemented by technical and organisational measures including encryption in transit and at rest, secret rotation, least-privilege access and request-level PII stripping for telemetry.

    Change notifications & DPA copies

    Customers can subscribe to advance change notifications (new processor, region change, transfer mechanism change) and request signed DPA / SCC module references by emailing [email protected] from the account email. We respond within 5 business days.

    Forbidden processors

    We do not use Russian-jurisdiction social or hosting platforms (including VK, OK.ru, TenChat) anywhere in the product or its operations.