Sub-processors

1. Introduction

1.1. This list contains the sub-processors engaged by Genz IT Solutions GmbH ("Provider") for the provision of the cloud services of the Capawesome Platform. It forms part of the Data Processing Agreement (DPA) as Annex 3.

1.2. The listed sub-processors process customer data on behalf of the Provider, including end-user data, source code, build artefacts, and bundle metadata transmitted via the cloud services.

1.3. Not covered by this list:

• Apple and Google: For App Store Publishing, the Provider acts as an API pass-through to the customer's own developer accounts. Apple and Google are independent controllers with a direct contractual relationship with the customer, not sub-processors of the Provider.
• Merchant of Record (Polar Software Inc., Lemon Squeezy LLC): These entities act as independent controllers in the purchase process, not as sub-processors of the Provider. Their privacy policies are available on their respective websites.
• Recipients engaged by the Provider as controller: Service providers that the Provider engages solely for its own purposes (e.g. email hosting, support chat, error monitoring, email delivery) are listed in the Privacy Policy at https://capawesome.io/legal/privacy-policy/.

2. Change Notification

2.1. The Provider shall notify customers at least 30 days before the intended engagement of a new or changed sub-processor in text form. Customers may track changes via email notification or by subscribing to this page.

2.2. In the event of a justified objection on data protection grounds, the provisions of Section 7 of the DPA shall apply.

3. Current Sub-processors

Name	Purpose / categories of data processed	Processing location	Transfer mechanism
Scaleway SAS	Cloud infrastructure (compute, storage, Mac build instances for iOS builds). Processes application delivery data, build artefacts, source code, publishing artefacts, workflow data.	France, EU	Adequacy (EU)
Hetzner Online GmbH	Backups (including customer data), proxy servers for the delivery of live updates to end-user devices.	Germany, EU	Adequacy (EU)
Cloudflare, Inc.	API gateway, CDN, file and bundle hosting. Customer data (including application delivery data and bundles) transits through Cloudflare infrastructure. On customer opt-in, AI-assisted analysis of build logs via Workers AI (no training on customer data, no retention beyond the request).	USA	EU-US Data Privacy Framework (DPF-certified); EU Standard Contractual Clauses (SCCs) as fallback
PlanetScale, Inc.	Database services. Stores customer data including certificate metadata, bundle metadata, and device identifiers.	USA	EU-US Data Privacy Framework (DPF-certified); EU Standard Contractual Clauses (SCCs) as fallback

4. Change History

Date	Change
2026-05-09	Cloudflare scope extended: AI-assisted build log analysis via Workers AI (opt-in, no training, no retention)
2026-04-16	Rewrite: sub-processor list scoped to DPA (processor-side sub-processors only); controller-side recipients moved to Privacy Policy
2025-07-25	Previous version