Sub-processors
| Sub-processor | Purpose | Data categories | Region | Transfer mechanism | DPA / legal basis |
|---|---|---|---|---|---|
| Hostinger International Ltd. | App hosting (servers, database, object storage) | All app data | Frankfurt, DE | EU (no transfer) | Available in Hostinger customer portal |
| AKI.IO GmbH, Marienburger Str. 1, 10405 Berlin, DE | AI features (meter-photo reading, contract/invoice analysis, offers-assistant chat) — only when user enables | Meter photo, contract/invoice text (read on your device from the PDF or photo; IBAN and — where your account profile provides it — your name masked before sending), chat history (last 20 turns). No user ID or file name is sent; names or addresses inside a contract text may still be read by the model. Prompts and outputs are processed in volatile memory only (not stored) and are not used for training. Sole sub-processor of AKI.IO: AIME GmbH, Berlin. | Germany / EU | Data processing agreement under Art. 28 GDPR — no third-country transfer | DPA |
| Functional Software Inc. d/b/a Sentry (incl. Sentry GmbH Berlin) | Crash and error diagnostics (app, servers, website, staff web apps) | Stack traces, error messages (personal details redacted), page/request paths, device info, app version. No IP stored; no user identifier attached (staff-tool paths may contain pseudonymous account ids). | Frankfurt, DE (EU ingest) | SCCs + EU–US DPF (Frankfurt EU ingest; intra-group US not excluded) | DPA |
| Twilio Inc. (incl. SendGrid business unit) | Transactional email / SMS, when enabled | Email address, message content | USA | SCCs + EU–US DPF | DPA |
| Google Ireland Ltd. (ML Kit Text Recognition) | On-device OCR model delivery on Android | Model binary only — no image data transmitted | EU | EU | n/a (no data transfer) |
| Apple Inc. (Vision framework) | On-device OCR on iOS / macOS | No data transmitted to Apple | On-device | n/a | n/a |
| Twilio SendGrid | Transactional and operator-initiated service/administrative email delivery | Email address, message content | Denver, USA | SCCs + EU–US DPF | DPA |
| Google Ireland Ltd. (Firebase Cloud Messaging) | Delivery of operator service push notifications (privacy policy § 6.12, § 18) | Push registration token, platform, notification content — no analytics, Firebase Analytics switched off | EU; intra-group transfer to Google LLC (USA) possible | SCCs + EU–US DPF (Google LLC) | DPA |
Last reviewed: 9 October 2026.