Subprocessor Register — versions
Versions of this document
Every change to the text creates a new version with its own checksum. This list shows which text applied when.
Version | Date | What changed | Checksum (sha256) | Text |
|---|---|---|---|---|
4.3.1 (current) | 26.09.2026 | Date reference in the annex harmonised. |
| Full text |
4.3.0 | 25.09.2026 | English version translated as a complete table; it now matches the German version (email delivery via Clerk and SendGrid). |
| Full text |
4.2.2 | 23.09.2026 | No change to the published text. |
| on request |
4.2.1 | 23.09.2026 | No change to the published text. |
| on request |
4.2.0 | 22.09.2026 | English version corrected: website media are delivered through the SnapNext tenant in the EU. Two open entries closed. |
| on request |
3.1.0 | 16.09.2026 | Open entries replaced by the actual current state. |
| on request |
3.0.0 | 16.09.2026 | Cloudinary removed. Supabase now also stores media. Region for Google Vertex AI named. The GPU provider remains only as a planned entry with no processing. |
| on request |
2.0.0 | 10.08.2026 | Earliest archived version. |
| on request |
Full texts of early working versions containing internal review notes are available on request from max@ultido.com; their checksum is shown in the list.
Version 4.3.1 · as of 26.09.2026
Checksum: sha256-862adead980e3ecd167a83bc49635126c88af470204d7084c6aff7d8fa51b941
# | Provider | Purpose | Data category | Region / place of processing | Transfer mechanism | Layer |
|---|---|---|---|---|---|---|
1 | Vercel Inc. | Hosting / serverless / frontend delivery (including aggregated web telemetry "Vercel Analytics") | App data, lead at collection where applicable | EU region (fra1); US parent | EU-US DPF (listed, as at 16.09.2026) + SCC fallback | Platform + [Lead] |
2 | Clerk Inc. | Authentication / identity and delivery of all profile emails (double opt-in, account creation, password reset, reward) via the sub-processor SendGrid (#10) | Email, account ID, consent flags | USA (EU residency is not available – no product feature, no commitment) | EU-US DPF (certified; dispute resolution JAMS) + SCC fallback in the DPA; EU representative: VeraSafe Ireland Ltd.; TIA maintained | Platform |
3 | Supabase Inc. | Database / backend and media storage (object storage) for image output | App data, consent log, lead, stylised images | EU (eu-central-1, Frankfurt); US parent | DPA + SCC 2021/914 (no DPF listing of its own – not relied on under DPF) + EU region | Platform + [Lead] |
4 | (discontinued – platform only) | Cloudinary Ltd. – decommissioned for the platform, no processing any more. For the website ultido.com Cloudinary continues to run, see #9c. Since the switch, image output runs via Supabase Storage (#3). The entry remains for the record. | – | – | – | – |
5 | Google LLC – Cloud / Vertex AI | AI image stylisation (inference), model imagen-3.0-capability-001 | Photo (transient, not stored) | us-central1 (USA) | EU SCCs via the Google Cloud DPA ("Cloud Data Processing Addendum", accepted 22.07.2026) | Platform (AI) – not active in the pilot |
6 | GPU host (self-hosted inference) – planned entry | Planned second inference route for some style classes. No such system exists today; no processing takes place over this route. The entry will be completed with provider, region and DPA before it goes live, which then triggers the 30-day notice. | – (none at present) | (to be completed before going live) | (to be completed before going live) | Platform (AI) – not in operation |
7 | CCM19 (Papoo Software & Media GmbH) | Consent management (cookies, § 25 TDDDG) | Consent status, technical data | Germany | DPA (EU) | Platform |
9 | SnapNext GmbH + Co. KG | Operation/development of the live platform (service contract + DPA), Google Workspace tenant (Ultido as its own organization/OU), delivery of the media of ultido.com via its Cloudinary tenant | App/operational data depending on the activity; DSAR/contact mailbox | Germany (Pulheim) | DPA Ultido↔SnapNext with flow-down under Art. 28(4) | Platform + [Lead] |
9b | └ Google LLC (Workspace) | Mail/docs/DSAR mailbox (max@ultido.com in the SnapNext tenant, own OU) – guest personal data possible in support/DSAR emails | Email correspondence | USA | EU-US DPF + SCC fallback | Platform + [Lead] |
9c | └ Cloudinary (SnapNext tenant) | Delivery of the media of ultido.com; connection data of website visitors. Does not concern the guest app – its image output is stored in Supabase (#3) | IP, connection data | EU | via the DPA Ultido↔SnapNext (signed 22.09.2026) | Website |
10 | └ Twilio Inc. (SendGrid) | Technical delivery of all profile emails triggered by Clerk – double opt-in, account creation, password reset – and of the reward emails | Email, name | USA | EU-US DPF; sub-processor of Clerk (#2), passed through via its DPA | [Lead] + Reward |
Annex – internal tools without guest personal data (for transparency, not sub-processors in the strict sense)
Tool | Purpose | Region | Note |
|---|---|---|---|
Slack | Internal communication only. No product integration, no automated delivery of reports, no guest personal data (as of 18.09.2026) | US (DPF) | If an automation later writes to a Slack channel, this entry will be reassessed |
Version 4.3.0 · as of 25.09.2026
Checksum: sha256-10d958154072a5ca5b5c9c415f8002ecb3d6f2e4685c95f0d297725a75cb5199
# | Provider | Purpose | Data category | Region / place of processing | Transfer mechanism | Layer |
|---|---|---|---|---|---|---|
1 | Vercel Inc. | Hosting / serverless / frontend delivery (including aggregated web telemetry "Vercel Analytics") | App data, lead at collection where applicable | EU region (fra1); US parent | EU-US DPF (listed, as at 16.09.2026) + SCC fallback | Platform + [Lead] |
2 | Clerk Inc. | Authentication / identity and delivery of all profile emails (double opt-in, account creation, password reset, reward) via the sub-processor SendGrid (#10) | Email, account ID, consent flags | USA (EU residency is not available – no product feature, no commitment) | EU-US DPF (certified; dispute resolution JAMS) + SCC fallback in the DPA; EU representative: VeraSafe Ireland Ltd.; TIA maintained | Platform |
3 | Supabase Inc. | Database / backend and media storage (object storage) for image output | App data, consent log, lead, stylised images | EU (eu-central-1, Frankfurt); US parent | DPA + SCC 2021/914 (no DPF listing of its own – not relied on under DPF) + EU region | Platform + [Lead] |
4 | (discontinued – platform only) | Cloudinary Ltd. – decommissioned for the platform, no processing any more. For the website ultido.com Cloudinary continues to run, see #9c. Since the switch, image output runs via Supabase Storage (#3). The entry remains for the record. | – | – | – | – |
5 | Google LLC – Cloud / Vertex AI | AI image stylisation (inference), model imagen-3.0-capability-001 | Photo (transient, not stored) | us-central1 (USA) | EU SCCs via the Google Cloud DPA ("Cloud Data Processing Addendum", accepted 22.07.2026) | Platform (AI) – not active in the pilot |
6 | GPU host (self-hosted inference) – planned entry | Planned second inference route for some style classes. No such system exists today; no processing takes place over this route. The entry will be completed with provider, region and DPA before it goes live, which then triggers the 30-day notice. | – (none at present) | (to be completed before going live) | (to be completed before going live) | Platform (AI) – not in operation |
7 | CCM19 (Papoo Software & Media GmbH) | Consent management (cookies, § 25 TDDDG) | Consent status, technical data | Germany | DPA (EU) | Platform |
9 | SnapNext GmbH + Co. KG | Operation/development of the live platform (service contract + DPA), Google Workspace tenant (Ultido as its own organization/OU), delivery of the media of ultido.com via its Cloudinary tenant | App/operational data depending on the activity; DSAR/contact mailbox | Germany (Pulheim) | DPA Ultido↔SnapNext with flow-down under Art. 28(4) | Platform + [Lead] |
9b | └ Google LLC (Workspace) | Mail/docs/DSAR mailbox (max@ultido.com in the SnapNext tenant, own OU) – guest personal data possible in support/DSAR emails | Email correspondence | USA | EU-US DPF + SCC fallback | Platform + [Lead] |
9c | └ Cloudinary (SnapNext tenant) | Delivery of the media of ultido.com; connection data of website visitors. Does not concern the guest app – its image output is stored in Supabase (#3) | IP, connection data | EU | via the DPA Ultido↔SnapNext (signed 22.09.2026) | Website |
10 | └ Twilio Inc. (SendGrid) | Technical delivery of all profile emails triggered by Clerk – double opt-in, account creation, password reset – and of the reward emails | Email, name | USA | EU-US DPF; sub-processor of Clerk (#2), passed through via its DPA | [Lead] + Reward |
Annex – internal tools without guest personal data (for transparency, not sub-processors in the strict sense)
Tool | Purpose | Region | Note |
|---|---|---|---|
Slack | Internal communication only. No product integration, no automated delivery of reports, no guest personal data (confirmed 18.09.2026) | US (DPF) | If an automation later writes to a Slack channel, this entry will be reassessed |