As of: 4 October 2026 (providers' contractual bases checked on 3 October 2026)
This is a courtesy translation. In case of doubt, the German version prevails.
This list names the service providers we use for the Nema Services that process personal data in doing so. It supplements Sections 15 and 16 of the Privacy Policy and is Annex B of the Data Processing Agreement. We enter a new or changed provider that processes your content here at least 30 days before it is used and notify you of it by email. You can object under Terms Section 3.14 and, as a business, under DPA Section 7.
Used by us
| Category | Provider | Seat | Place of processing | Contract and basis for third country |
|---|---|---|---|---|
| Data centre (server, database, workshops, reach measurement, email sending) | Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen | Germany | EU | data processing agreement; no third-country transfer; certified to ISO/IEC 27001 |
| Intermediary service for model interfaces (Nema runtime: text and image analysis) | OpenRouter, Inc., 169 Madison Avenue, New York, NY 10016 | USA | USA | OpenRouter's data processing agreement (Data Processing Agreement, part of its terms of service) with the European Commission's standard contractual clauses; not certified under the Data Privacy Framework |
| Operator of the language model for text (Nema runtime), currently the model DeepSeek V4 Flash. Specified by us, in this order; if none is reachable, the request fails | 1. Deep Infra Inc. · 2. Microsoft Corporation (Azure) · 3. Parasail, Inc. | USA | USA | sub-processors of OpenRouter, only as long as OpenRouter lists them as not storing requests (zero data retention). We have no contract of our own with them. They receive the data from OpenRouter within the USA; OpenRouter is answerable for this under the standard contractual clauses. Microsoft Corporation is certified under the Data Privacy Framework; Deep Infra and Parasail are not |
| Operator of the model for image analysis (Nema runtime), currently the model Mistral Small. Specified by us; if it is not reachable, the request fails | Mistral AI SAS, 15 rue des Halles, 75001 Paris (endpoint in the EU) | France | EU | sub-processor of OpenRouter, only as long as OpenRouter lists it as not storing requests (zero data retention); we have no contract of our own with it |
| Payment processing | Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2 | Ireland | EU/USA | data processing agreement as part of the Stripe contract. Transfer to Stripe, LLC (USA): Data Privacy Framework, under which Stripe, LLC is certified, and standard contractual clauses in Stripe's Data Transfers Addendum |
Other recipients that are not sub-processors
| Purpose | Recipient | What goes there |
|---|---|---|
| Push notifications to the iPhone | Apple Push Notification Service (Apple Inc., USA; in the EEA Apple Distribution International Ltd., Ireland), under Apple's developer terms. Apple is not certified under the Data Privacy Framework and, by its own account, bases transfers from the EEA on standard contractual clauses | name of the agent, where applicable the channel, the first 180 characters of the message; for email drafts recipient and subject |
| Web search of the Nema runtime | DuckDuckGo | search term, from our server |
| Checking the VAT IDs of businesses in other EU states | European Commission's confirmation procedure (VIES) | the VAT ID checked and our own VAT ID |
Not used by us, but chosen by you
These recipients receive data only if you or a member of your organisation set them up. They act on the basis of your own contract with them and are not our sub-processors:
- Anthropic (USA) — with the Claude Code runtime using your own Claude subscription; in organisations only after confirmation by an Admin or Owner
- OpenAI (USA) — with the Codex runtime using your own ChatGPT subscription; in organisations only after confirmation by an Admin or Owner
- connected services (modules), an agent's mailbox and your own MCP servers
Without third parties
These functions run on our own server and pass nothing to third parties: search and memories (vectors), speech output, speech-to-text conversion, reach measurement, email sending.
Optional services that are not currently active — such as a messenger connection or an external computing service for speech output — will be entered here and announced before we switch them on.