Subprocessors
Last updated: 29 October 2026
Onda Dev uses the companies below to run parts of Trovaso. Each one receives personal data only for the job named here, under a written contract that binds it to at least the obligations in our data processing agreement, and we remain responsible to you for what they do. This is the list that agreement and our privacy policy refer to.
| Service | What it does for Trovaso | Data it receives | Location |
|---|---|---|---|
| Google Cloud / Firebase | Accounts and sign-in, the database that holds workspace data (Firestore), storage for uploaded files, bot protection (reCAPTCHA, App Check). | Customer accounts; workspace data — roster, conversations, contracts, payment confirmations, sales totals; uploaded files; browser signals for bot checks. | EU and US |
| Hetzner Online | Hosting of the servers Trovaso runs on. | Everything the application handles while it runs; server logs. | Falkenstein, Germany |
| Cloudflare | DNS and the proxy in front of our servers: request routing and protection. | Visitor IP addresses and request metadata (addresses, headers) while a request passes through. | Global edge network |
| Stripe | Billing: subscriptions, card payments, invoices, the billing portal. | Customer name, email and billing address; card details, which Trovaso itself never sees; payment history. | US and EU |
| Resend | Sending transactional email and the outreach email customers send from their own domain; receiving replies. | Sender and recipient names and addresses, the content of emails sent and received, delivery events. | US, on Amazon Web Services |
| Anthropic | AI models that vet creators and draft: fit scores, replies in the Deals inbox, translations, contract drafts, reading imported files. | Creator profiles and posts, conversation text, deal terms and drafts — with payment details, phone numbers and tax ids replaced by placeholders before anything is sent. | US |
| OpenAI | AI vetting of public creator profiles. | Public creator profile text and posts, with the same placeholders. | US |
| Apify | Reading public creator posts and profiles on TikTok, Instagram and YouTube. | The handles, hashtags and links to read; returns the public data. | EU (Czech Republic) |
| ScrapeCreators | Reading public posts, profiles and comments. | The handles and post links to read; returns the public data. | US |
| PostHog | Product analytics. | Usage events tied to a customer's user id (for example “started a checkout”), browser and page data. | EU cloud (Frankfurt) |
| Frankfurter | Exchange rates for the revenue import. | No personal data: only currency codes and dates. | EU |
1. Where the data goes
Some of these providers are in the United States. Where personal data from the EU, the UK or Switzerland reaches them, we rely on the safeguards the law provides: the EU–US Data Privacy Framework where the provider is certified under it, and otherwise Standard Contractual Clauses, with the UK addendum where it applies. Section 7 of the data processing agreement has the detail.
2. Changes to this list
We update this page before a new provider starts receiving personal data, with the date at the top and an entry in the log below. If you have a Trovaso account, you can object to a new provider within 30 days of the change by writing to team@trovaso.com with your reason. We will look for a way to keep serving you without it; if there is none, you may close your account before the change applies, and we will refund any part of a subscription you paid for and did not use.
3. Change log
- 29 October 2026 — First published list.
Contact
Onda Dev · team@trovaso.com