Subprocessor list
Companies that process personal data on our behalf (processors under GDPR Art. 28). Our privacy policy and data processing agreement both refer to this list. Some providers are based in the United States. Each row shows how the data is protected when it is transferred.
| Provider | Country / region | Purpose of processing | Safeguard for transfers outside the EU | Status | Data processing agreement |
|---|---|---|---|---|---|
| Render | Germany, Frankfurt (US company) | Hosting of the application server and the database | EU Standard Contractual Clauses (SCC) | Active | Open |
| Cloudflare R2 | European Union | Storage of uploaded production files (e.g. DXF, STL) and invoice PDFs | Data stays in the EU and is not transferred outside it | Active | Open |
| Cloudflare Turnstile | United States (global server network) | Signup form bot protection — visitor IP address and technical data | EU Standard Contractual Clauses (SCC) | Active | Open |
| Stripe | Ireland (data center), US parent company | Payment processing (shop orders and Forgmatic subscriptions) and invoicing for Forgmatic subscriptions | EU Standard Contractual Clauses (SCC) and the EU-US Data Privacy Framework | Active | Open |
| Resend | United States | Delivery of service emails (sign-in links, receipts) | EU Standard Contractual Clauses (SCC) | Active | Open |
| Sentry | Germany (EU) | Error tracking. Server errors always, browser errors only with consent to analytics cookies (see the Cookie Policy) | EU Standard Contractual Clauses (SCC) | Active | Open |
| Better Stack | United States | Uptime monitoring, a public status page and incident records (operational data and technical data of status-page visitors) | EU Standard Contractual Clauses (SCC) and the EU-US Data Privacy Framework | Active | Open |
| Vercel | United States | Hosting of the website, shops and admin, and fast page delivery | EU Standard Contractual Clauses (SCC) and the EU-US Data Privacy Framework | Active | Open |
Other services (not processors)
We use these services, but they do not process personal data for us. Either no personal data is sent to them, or they handle it as an independent controller under their own terms.
| Provider | Country / region | Purpose of processing | Safeguard for transfers outside the EU | Status | Terms |
|---|---|---|---|---|---|
| Ireland (Google Ireland) / United States (parent) | Sign in with Google when the user chooses it (identity provider — acts as an independent controller) | EU Standard Contractual Clauses (SCC) and the EU-US Data Privacy Framework | Active | Open | |
| ARES | Czech Republic | Company lookup by ID number (IČO) in the Czech public business register | Public register, no personal data is sent | Active | — |
Last updated Oct 12, 2026