Sub-processor list

The providers below process personal data on behalf of WeldStack to the extent necessary to deliver the service. We notify account owners of intended changes to this list by e-mail at least 14 days in advance, with the right to object on reasonable grounds (§5 of the Data Processing Agreement).

Sub-processors are vetted before engagement and periodically for compliance with Art. 28 GDPR.

Google Cloud (Google Ireland Ltd / Google LLC)

Service / data scope: Infrastructure hosting: application, database, file storage, scheduled jobs — all service data.

Processing location: Region europe-central2 (Warsaw, EU)

Sub-processing and transfer basis: Google Cloud Data Processing Addendum (CDPA) + Standard Contractual Clauses (SCC)

Google Vertex AI (Gemini)

Service / data scope: AI features triggered by the user: certificate OCR, inspection transcript correction, speech-to-text (fallback).

Processing location: Global endpoint (processing possibly outside the EEA)

Sub-processing and transfer basis: CDPA (no use of customer data for model training) + SCC under the CDPA / Google’s EU-U.S. DPF certification

Resend, Inc.

Service / data scope: E-mail delivery: transactional, notifications, inspection reports with PDF attachments — e-mail addresses and message content.

Processing location: USA

Sub-processing and transfer basis: Resend Data Processing Agreement; transfers: EU-US DPF / SCC

Functional Software, Inc. (Sentry)

Service / data scope: Application error monitoring — technical event data with personal data filtered at the source.

Processing location: USA (event ingestion: EU region — Germany)

Sub-processing and transfer basis: Sentry Data Processing Agreement; transfers: EU-U.S. DPF; SCC in the DPA as a fallback mechanism

ElevenLabs, Inc.

Service / data scope: Speech-to-text conversion of voice recordings (STT) — inspection audio recordings.

Processing location: USA

Sub-processing and transfer basis: Data processing agreement under Art. 28 GDPR; transfers: Standard Contractual Clauses (SCC); additionally the provider’s EU-U.S. DPF policy; data is not used to train the provider’s models

Analytics tools

Google (Google Analytics 4) processes statistical data on behalf of WeldStack as the controller of the website (Google Ads Data Processing Terms) — only with consent given in cookie settings; outside the scope of this data processing agreement (it does not concern data entrusted by customers).

Independent controllers (not sub-processors)

The entities below process data as independent controllers — within their own services, under their own terms and privacy policies:

Paddle.com Market Ltd

Merchant of Record — subscription seller: payment, tax and invoice handling (payment data never reaches WeldStack).

Google LLC ("Sign in with Google")

Google account sign-in (at the user’s request) — Google acts as an independent controller within its own sign-in service.

Last change to the list: 2026-08-03 — update of transfer mechanism descriptions; 2026-08-02 — first publication.

Questions about sub-processors and data processing: [email protected].