Legal
Processors and sub-processors
ThemePunch OHG uses the following processors for SR Anywhere. The list is Annex 3 of the data processing agreement for business customers. We announce an added or replaced sub-processor on this page at least 30 days before it is engaged; to be told by e-mail as well, write to info@themepunch.com with the subject "Sub-processor updates".
| Provider | Seat | Location of processing | What for | Data | Safeguard |
|---|---|---|---|---|---|
| Cloudflare, Inc. | San Francisco, USA | Cloudflare's global network; EU data centres for European visitors; the database and the file storage (modules, media, their backup) in the EU, with Cloudflare's EU jurisdiction; the short key records the edge reads to deliver a module replicated worldwide | hosting of the portal and the site, the API, storage of modules and media and their nightly backup, delivery of modules to customers' sites, our mails (sign-in links, account mails, help mails) with their delivery events (Cloudflare's Email Service; its sending log up to 31 days), e-mail routing for help@, view counts, analytics events (about three months), our AI service, the modules' preview pictures (ThemePunch's own render service on Cloudflare's browser rendering) | account data, modules, media, help requests, the mails we send (address, content, delivery states), visitors' requests at the edge | Cloudflare's Customer DPA (version 6.4 of 3 April 2026), EU-US Data Privacy Framework; failing that, the Standard Contractual Clauses in that DPA |
| Paddle.com Market Limited | London, UK | UK, EU, USA | merchant of record: checkout, payment, invoices, subscriptions, customer portal | billing details, payment data, transaction ids | independent controller for the purchase; UK adequacy decision |
| Brevo (Sendinblue SAS) | Paris, France | EU | the product news list (double opt-in) and its newsletters; our mails only when Cloudflare cannot take one (its daily limit, an outage), with their delivery events and unsubscribes | e-mail address, the mail, delivery states; for product news the address and the confirmation | DPA (Appendix 3 of Brevo's terms); EU |
| Amazon Web Services EMEA SARL | Luxembourg | EU (Amazon Bedrock, AWS's EU Regions; reached through ThemePunch's own AI service on Cloudflare) | the language model (Claude Haiku by Anthropic) for the AI preparation of help requests (a summary, checks, a draft, translation) and the editor's AI assist | help: pseudonymised request texts with the facts gathered for the supporter and our pseudonymised replies to up to three similar solved requests, the module's content only under a support grant; assist: the request, the module's texts, brand colours and fonts, what the customer said about their business | AWS GDPR DPA (with the Standard Contractual Clauses for any transfer); processing in the EU; Bedrock stores neither requests nor answers (its logging of model calls is switched off); no training, nothing passed to Anthropic |
| OpenAI Ireland Ltd | Dublin, Ireland | OpenAI's infrastructure; transfers outside the EU as OpenAI's DPA sets out | the second engine of our AI service (gpt-4o-mini): used when we switch an AI area to it in our administration, or when Bedrock cannot be reached | as for Amazon Web Services above | OpenAI's Data Processing Addendum; requests sent with storage off, no training; onward transfers under the Standard Contractual Clauses or an adequacy decision |
| monday.com Ltd. | Tel Aviv, Israel | United States (monday's US data region) | fault reports from help requests on the developers' board | the request's number and subject, topic, plan, account id, module, page, browser and error messages, the supporter's notes; never the customer's address or messages | monday.com's DPA (incorporated in its terms); the EU adequacy decision for Israel (monday.com Ltd.); for the storage in the US the Standard Contractual Clauses in that DPA and the EU-US Data Privacy Framework (monday.com, Inc.) |
| Railway Corporation | San Francisco, USA | USA | hosting of ThemePunch's own analytics database (13 months of events from our website, the portal and the editor) | analytics events: page, event, time, device class, country, a daily visitor code; for signed-in use the account | Railway's Data Processing Addendum with the Standard Contractual Clauses |
Not processors: Patchstack OÜ (Pärnu, Estonia), which runs the vulnerability disclosure program for our products, receives the security reports from help requests and handles them under its own responsibility. The provider of an assistant you connect yourself (Anthropic or OpenAI through Settings → Connections) acts under your own contract; YouTube or other media providers you link inside a module act under their own rules towards your visitors. Hugging Face, Inc. (USA) and jsDelivr (a public content delivery network for open-source files), from which your browser downloads the depth model, its library and its runtime once (Depth maps for Layer Depth effects), see only that download — your IP address, your browser — and never the photo; they act under their own policies.
Not used any more: Anthropic PBC as a direct provider (the account is parked since 2026-09-29; Anthropic's model runs on Amazon Bedrock in the EU instead).
Last updated: 29 October 2026.