Sub-processors¶
Last Updated: 2026-04-16
1. Introduction¶
1.1. This list contains the sub-processors engaged by Genz IT Solutions GmbH ("Provider") for the provision of the cloud services of the Capawesome Platform. It forms part of the Data Processing Agreement (DPA) as Annex 3.
1.2. The listed sub-processors process customer data on behalf of the Provider, including end-user data, source code, build artefacts, and bundle metadata transmitted via the cloud services.
1.3. Not covered by this list:
- Apple and Google: For App Store Publishing, the Provider acts as an API pass-through to the customer's own developer accounts. Apple and Google are independent controllers with a direct contractual relationship with the customer, not sub-processors of the Provider.
- Merchant of Record (Polar Software Inc., Lemon Squeezy LLC): These entities act as independent controllers in the purchase process, not as sub-processors of the Provider. Their privacy policies are available on their respective websites.
- Recipients engaged by the Provider as controller: Service providers that the Provider engages solely for its own purposes (e.g. email hosting, support chat, error monitoring, email delivery) are listed in the Privacy Policy at https://capawesome.io/privacy.
2. Change Notification¶
2.1. The Provider shall notify customers at least 30 days before the intended engagement of a new or changed sub-processor in text form. Customers may track changes via email notification or by subscribing to this page.
2.2. In the event of a justified objection on data protection grounds, the provisions of Section 7 of the DPA shall apply.
3. Current Sub-processors¶
| Name | Purpose / categories of data processed | Processing location | Transfer mechanism |
|---|---|---|---|
| Scaleway SAS | Cloud infrastructure (compute, storage, Mac build instances for iOS builds). Processes application delivery data, build artefacts, source code, publishing artefacts, workflow data. | France, EU | Adequacy (EU) |
| Hetzner Online GmbH | Backups (including customer data), proxy servers for the delivery of live updates to end-user devices. | Germany, EU | Adequacy (EU) |
| Cloudflare, Inc. | API gateway, CDN, file and bundle hosting. Customer data (including application delivery data and bundles) transits through Cloudflare infrastructure. | USA | EU-US Data Privacy Framework (DPF-certified); EU Standard Contractual Clauses (SCCs) as fallback |
| PlanetScale, Inc. | Database services. Stores customer data including certificate metadata, bundle metadata, and device identifiers. | USA | EU-US Data Privacy Framework (DPF-certified); EU Standard Contractual Clauses (SCCs) as fallback |
4. Change History¶
| Date | Change |
|---|---|
| 2026-04-16 | Rewrite: sub-processor list scoped to DPA (processor-side sub-processors only); controller-side recipients moved to Privacy Policy |
| 2025-07-25 | Previous version |