Sub-processor list
Version 2.1.0 · gäller från 2026-09-02
Richard Gyor uses the following processors and third parties to provide ProjectDigo.
| Provider | Purpose | Data processed | Location / transfer |
|---|---|---|---|
| Atlas Cloud AI Inc. (AI generation) — 1540 Broadway, New York, USA | Text, image, and video generation | Prompts and story context; for image editing, the source images. Never your name, email or account identity | USA. Per its published data-retention and data-deletion policies: submitted content retained up to 7 days, then scheduled for deletion; not used to train its models without written customer authorisation (none given). No data-processing agreement and no EU transfer mechanism (SCC / Data Privacy Framework) are in place yet — a disclosed, time-bounded gap the operator will close with its planned incorporation; the adult-content opt-in asks for your explicit consent to this transfer (GDPR Art. 49(1)(a)). |
| Third-party model providers routed by Atlas Cloud (at the time of writing: OpenAI, Google, BytePlus, Alibaba Cloud, xAI) | Running the underlying AI models | The same prompts/images, forwarded by Atlas Cloud to whichever provider serves the selected model | Predominantly USA. Each provider's own retention and data-use practices may apply; Atlas Cloud states it does not represent them as identical. We do not contract with them directly — they are the AI provider's sub-processors. |
| Hetzner Online GmbH (hosting) | Running the application and storing all data at rest | All service data | Germany (EU). Hosting DPA per Hetzner's standard terms. |
| Email delivery (self-hosted mail server) | Transactional and (if opted in) marketing email | Email address, message content | Operator-run infrastructure (EU) — not a third party. |
| Cloudflare, Inc. (Turnstile bot protection) | Verifying that a registration attempt comes from a person | IP address, browser characteristics, the widget interaction | USA — EU–US Data Privacy Framework participant. Used ONLY on the registration flow. |
| Google Ireland Ltd / Google LLC (Google Analytics 4) | Usage statistics of the public marketing site only — never the app | Pseudonymous usage data; loads only after you accept analytics cookies in the banner, with IP anonymisation and advertising features disabled | EU/USA — EU–US Data Privacy Framework. Withdraw any time via "Cookie settings" on the marketing site. |
| Waitlist site (Drupal landing) | Early-access waitlist signups | Email, country, language, consent | Same operator and infrastructure as the main service. |
Not sub-processors
Two parts of the Service look like third-party involvement but are deliberately built so that no personal data of yours reaches the third party:
- Geolocation (MaxMind GeoLite2). We download MaxMind's country database and query it on our own server. Your IP address is never sent to MaxMind. The database is a data file, not a service, so MaxMind processes nothing on our behalf. This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
- Certified age verification (European age-verification solution). Not yet in operation. The protocol is zero-knowledge — the proof discloses only "over 18" and no identity attribute. When the integration goes live, this list will state whether the verifier runs on our own infrastructure (no sub-processor) or with a third party (added to the table).
Changes
When we add or replace a provider that affects how your personal data is processed, we will update this list and, where required, notify you. The effective date is shown above.
Contact
Questions: info@projectdigo.com.