Official Legal Document
Subprocessors
This is the official legal document published by Voice2Evolve.
Effective date
2026-03-02
Legal version
2026-06-02
Last updated
2026-06-02
Legal entity
Voice2Evolve UG (haftungsbeschränkt)
Registered office
Amtsgericht Stuttgart, HRB 803557
Last updated: June 2, 2026
Voice2Evolve UG (haftungsbeschränkt) ("Voice2Evolve") uses the following third-party subprocessors to deliver the Voice2Evolve Services. Subprocessors that process Personal Data on Voice2Evolve's behalf are subject to written data processing terms intended to provide protections appropriate to their role and consistent with the Master Data Processing Agreement (MDPA).
This list is maintained in accordance with GDPR Article 28(2). Voice2Evolve will provide reasonable prior notice of new or changed subprocessors. To receive notifications, contact help@voice2evolve.com.
Current Subprocessors
| Provider | Role | Data Location | Legal Safeguards |
|---|---|---|---|
| Supabase Inc. | Database, Authentication | EU (Stockholm, Sweden primary hosting); onward transfers to United States / Singapore subprocessors | Supabase DPA + SCCs + supplementary safeguards documented in Supabase TIA |
| OpenAI, L.L.C. | AI inference and voice processing where used | EU / United States / international, depending on service configuration | OpenAI DPA + SCCs + additional contractual and technical safeguards where applicable |
| Google Cloud Platform (Google Cloud EMEA Limited / Google LLC) | AI inference and cloud processing where used | EU / United States / selected Google Cloud regions depending on service configuration | Google Cloud CDPA + SCCs + DPF where applicable |
| Microsoft Azure (Microsoft Ireland Operations Limited / Microsoft Corporation) | AI inference and cloud processing where used | EU / United States / selected Microsoft Azure regions depending on service configuration | Microsoft Products and Services DPA + SCCs + DPF where applicable |
| Stripe Payments Europe Ltd. | Payment Processing | EU / United States | GDPR DPA + SCCs |
| Vercel Inc. | Frontend Hosting (CDN) | EU / United States (AWS + Microsoft Azure + GCP; EU edge regions: Paris, Frankfurt, Sweden) | SCCs (Module 2, C2P) + UK IDTA |
| Railway Corp. (railway.com) | Backend Infrastructure | US / EU-region deployment (underlying infrastructure: GCP) | Executed DPA + EU SCCs (Module 2, C2P) + DPF |
| Cloudflare, Inc. | DNS Resolution, WebRTC TURN Relay | EU / United States | GDPR DPA + SCCs |
| Sentry, Inc. | Error Monitoring | EU / United States | GDPR DPA + DPF + SCCs + UK IDTA |
| Rybbit | Website & Product Analytics | EU (EEA — Hetzner; Cloudflare Object Storage) | GDPR DPA (accepted by use) + SCCs |
| Plus Five Five, Inc. (Resend) | Transactional Email | United States | GDPR DPA + DPF + SCCs + UK IDTA |
| Anthropic PBC | AI Inference (LLM) | United States | GDPR DPA + SCCs |
| Haufe-Lexware GmbH & Co. KG (Lexware) | Invoice & Accounting Synchronisation | EU (Germany) | GDPR DPA (AVV) |
Notes
- Vendor due diligence: Voice2Evolve reviews core subprocessors before use and maintains vendor, transfer, and configuration records for compliance purposes.
- Infrastructure and observability: Hosting, DNS, relay, database, authentication, and monitoring providers process only the data needed to operate and secure the service. Logs and error events are minimised and scrubbed where feasible.
- AI inference: AI subprocessors process prompts, model inputs, and outputs only where needed for the relevant feature. Voice2Evolve applies data minimisation before model calls.
- Analytics, email, payments and accounting: Analytics is limited to selected website and app areas and is disabled on sensitive session, analysis, account, billing, authentication, and administration areas. Transactional email, payment, fraud-prevention, and accounting providers process only the data needed for their respective roles.
- External identity providers: Identity providers selected by end users (for example Google or Microsoft for social sign-in) may act as independent controllers for their own authentication services. Voice2Evolve lists them as subprocessors only where Voice2Evolve engages them to process Customer Personal Data on the customer's behalf.
Contact
To receive advance notice of subprocessor changes or to raise an objection under GDPR Article 28(2), contact: