Sub-processors

Last updated: 12 September 2026

ReviewMix uses a small number of carefully selected sub-processors to deliver the service. We publish this list so customers can review exactly where their data is processed. When we add or replace a sub-processor that handles customer data, every customer is told by email at least 30 days before it takes effect, as our Data Processing Addendum sets out. Other changes to this list are announced to active paying customers the same way.

How this list is organised

Most entries below are true sub-processors: they handle personal data that a customer entrusts to us, and they fall under the sub-processor terms of our Data Processing Addendum. Two do not. PostHog Inc., and the Google Analytics half of the Google LLC entry, process data about the people who use our own websites and app — visitors, and our customers using the dashboard — where we are the controller and no data we hold on a customer's behalf is involved. We list them here anyway, in the same place and to the same level of detail, because a register that only names what a contract forces us to name is not a useful register. Each of those two says so in its own entry.

What each sub-processor does

Hetzner Online GmbH

• Location: Gunzenhausen, Germany (EU)
• Purpose: Cloud infrastructure — application servers, database, object storage, backups
• Data processed: all customer data (account info, widgets, testimonials, submitter PII, photos, consent ledger, audit logs)
• Legal basis: Art. 28 DPA (available from Hetzner)
• International transfers: none — all processing within Germany

Cloudflare, Inc.

• Location: EU edge nodes for our domains; corporate HQ in US
• Purpose: DNS, TLS termination, CDN for static widget assets, WAF, bot protection on the public testimonial collection page (Turnstile)
• Data processed: IP addresses of visitors (held briefly for routing and security); widget JavaScript bundle (no PII); for Turnstile, browser signals evaluated by the challenge widget on the collection page (no form content — the challenge runs in Cloudflare's iframe and never receives what a submitter typed)
• Legal basis: Art. 28 DPA + EU Standard Contractual Clauses
• International transfers: minimal; traffic served from EU edges; headers may briefly transit Cloudflare's global network for DDoS analysis

Stripe Payments Europe, Ltd.

• Location: Dublin, Ireland (EU)
• Purpose: Payment processing and EU VAT calculation for paid plans
• Data processed: customer name, email, billing address, VAT number, payment card (held by Stripe, not by us)
• Legal basis: Art. 28 DPA via Stripe Data Processing Agreement
• International transfers: Stripe may share data with Stripe, Inc. (US) under SCCs; we do not transmit payment data ourselves

Resend (Resend, Inc.)

• Location: EU delivery routing; corporate HQ in US
• Purpose: Transactional email (magic links, confirmations, notifications)
• Data processed: recipient email address, email body content
• Legal basis: Art. 28 DPA + SCCs
• International transfers: Resend operations may include US; EU region routing requested for our account

Google LLC

• Location: Mountain View, California, USA
• Purpose: Google Business Profile (GBP) API — business owners authorize ReviewMix to fetch and cache their Google reviews via OAuth 2.0 (the business.manage scope — the only scope Google offers for GBP; it does not split read from write). ReviewMix calls review-read methods, and — widened 2026-08-29 (M7 SEND) — the review-reply write method (reviews.updateReply / deleteReply), used solely to publish or retract the business owner's own reply to a review, at the owner's explicit request, under the owner's business name. Review data (author name, review text, star rating, profile photo URL, timestamp) is fetched from Google's API and immediately stored in EU Postgres (Hetzner). End-users are served from our EU cache — not directly from Google's infrastructure at display time. Amended 2026-09-09: Google Analytics 4 also measures usage of the marketing site, reviewmix.eu; the Google tag and GA4 property remain for planned Google Ads.
• Data processed: GBP review content accessed through the owner's authorized connection and the owner's reply text sent for publication or retraction; optional Google sign-in identity claims (email, name, account identifier). Amended 2026-09-09: marketing-site visitors, including visitors without an account, also contribute GA4 page/event data, referrer and device/browser information, and consented visitor/session cookie identifiers. The tag sends cookieless measurement pings while a visitor has not yet answered the banner; the cookie policy carries our basis for those and how to stop them. Magic-link authentication is distinct from this visitor analytics processing.
• Legal basis: Art. 28 DPA + EU Standard Contractual Clauses; Module 3 (Processor-to-Processor) is the June 2026 reviewed basis for the GBP integration. For marketing-site analytics ReviewMix is the controller, not a customer's processor, so that leg runs on your consent under Art. 6(1)(a) and Art. 5(3) ePrivacy with SCC Module 2 (Controller-to-Processor). Our basis for the tag's pre-consent measurement pings is legitimate interest under Art. 6(1)(f); the cookie policy states it and gives the route to object.
• International transfers: GBP requests originate from our EU application server to Google's US API endpoints; fetched review content is cached in EU Postgres and that cache is deleted on GBP disconnection. Google sign-in and marketing-site GA4 also involve Google LLC in the US under applicable SCCs; GBP disconnection governs the GBP cache, while the analytics choice governs GA4 storage.
• Advertising boundary: ad_storage, ad_user_data and ad_personalization remain denied under the shipped Consent Mode v2 configuration; lifting them requires a separate Google Ads commit and policy update.

PostHog Inc.

• Location: United States; PostHog Cloud EU, Frankfurt, Germany
• Purpose: Consent-required product analytics and masked session replay on reviewmix.eu and inside the app dashboard at app.reviewmix.eu, under the same consent choice; and, on that same choice, a small number of events sent from our own servers recording that a step reached a defined point
• Data processed: Visitor page views, referrer and device/browser information, anonymous distinct IDs and session IDs, interaction events and replay; typed input values are masked and images are blocked on both sites; on reviewmix.eu other page text is recorded, which is our own content, except a help-centre search the page repeats back; in the app dashboard page text is masked except our own interface text, marked readable one element at a time, element attributes are masked, and page addresses and links are sent without query strings; ReviewMix does not send PostHog any account identity, name or email address. The server-sent events carry only the event name, the time, and the same anonymous identifier read from the visitor's own browser; they are sent for four such steps — account created, sign-in completed, checkout started, account closure requested — and for no others, and only where that identifier already exists. They are the one case where something is recorded for people on pages the analytics library never loads on, namely sign-in and sign-up; what is recorded is that the step completed, not the page
• Legal basis: your consent under Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy Directive, with PostHog's data-processing agreement and EU Standard Contractual Clauses Module 2 (Controller-to-Processor) governing the transfer — Module 2 rather than the Module 3 used for the Google Business Profile integration, because here ReviewMix is the controller rather than a customer's processor
• International transfers: EU Cloud storage in Frankfurt; PostHog Inc. is a US recipient under SCCs. The first-party /ingest proxy changes the network path while PostHog Inc. remains the recipient.
• What this entry is not: website analytics is processing ReviewMix carries out as controller, about visitors to our own sites. It is not processing of a customer's personal data on that customer's behalf, so it does not fall under the sub-processor terms of our Data Processing Addendum, whose transfer list covers the services that handle customer data. It is listed here because we publish every third party that receives data about the people who use our sites, not only the ones the DPA obliges us to name. The same distinction applies to the Google Analytics half of the Google LLC entry above. Inside the app dashboard the people measured are our own customers using the service. The customer data those pages display — testimonials, reviews and the names of the people who wrote them — is kept out of PostHog: in replay, text is masked unless it is our own interface text that we have marked readable one element at a time, element attributes are masked and images are blocked; page addresses and links are sent without the query strings a search would appear in, and PostHog is not loaded on our internal administration pages. An automated test plants a marker string in dashboard searches and in displayed testimonial and review data — text, names, image descriptions and image addresses — and checks that it appears in nothing sent to PostHog while our marked interface text does arrive readable; with those controls that data is not sent to PostHog and this remains processing we carry out as controller.

Not sub-processors

The following services do not process ReviewMix customer data:

• GitHub — source code hosting only
• Plain — our support inbox; only processes data provided by customers who explicitly write to us

How to be notified of changes

When we add or replace a sub-processor that handles customer data, every customer is notified by email, as our Data Processing Addendum sets out. Other changes to this list are notified to active paying customers. Either way, the change takes effect 30 calendar days after notification. For an added or replaced sub-processor, objections and termination follow our Data Processing Addendum (§ 8.3). For other changes, customers who object may cancel without penalty before the change takes effect.

How to contact us about sub-processors

Email privacy@reviewmix.eu. We reply within 5 business days.

---