Subprocessors
Last updated: August 9, 2026
This page lists subprocessors used by Franz Josef Drexler where personal data is processed on behalf of business customers under the Data Processing Agreement.
A provider is listed here only where it processes customer personal data on my behalf as part of a processor relationship.
Providers contracted directly by a customer and operated under that customer’s own account are not my subprocessors merely because I configure, deploy to, or administer those services for the customer.
Current Subprocessors
| Provider | Purpose | Data potentially processed | Main processing location | Applicable services |
|---|---|---|---|---|
| Cloudflare, Inc. | Web hosting and edge infrastructure, CDN, network and application security, serverless processing, technical request handling, and delivery of transactional email notifications | Website and Interview Service traffic, IP addresses and request metadata, content transmitted through hosted applications, recipient email address, Creator and project name, dashboard link, technical identifiers, and other customer data processed through the relevant Cloudflare services | Global, including the EEA and United States | Interview Service; customer websites or infrastructure where operated through my Cloudflare account |
| Convex, Inc. | Application backend, database, authentication/session infrastructure, file storage, and scheduled/backend processing | Interview content, chat messages, project documents, generated content and images, technical metadata, and other application data | United States for the current Interview Service deployment | Interview Service; other customer services only where specifically deployed using Convex |
| OpenRouter, Inc. | AI gateway and dynamic routing of model requests to suitable downstream AI model and infrastructure providers | Interview instructions, Client and AI messages, project documents, requested changes, image prompts, and other content required for AI processing; technical request and routing metadata | United States and other locations involved in the dynamically selected AI processing chain | Interview Service and other customer services where AI functionality is provided through OpenRouter |
| AI model and infrastructure providers dynamically selected by OpenRouter | AI model inference for text and image generation through an endpoint selected by OpenRouter for the relevant request | Content included in AI requests and generated responses, including interview messages, project information, document content, image prompts, and generated visual content | Depends on the selected provider and endpoint, including the EEA, United States, or other locations identified in the current provider information | Interview Service and other AI-assisted services where the relevant provider is selected by OpenRouter for a particular request; current identities and data policies are available through the provider information linked below |
Conditional Subprocessors
The following provider is not necessarily used for every customer or service. It acts as a Subprocessor only where customer personal data is processed through infrastructure operated or controlled by me.
| Provider | Purpose | Data potentially processed | Main processing location | When applicable |
|---|---|---|---|---|
| Hetzner Online GmbH | Hosting infrastructure for self-hosted services, including privacy-focused website analytics where applicable | Depending on the relevant service: website analytics data, page views, session and device information, technical request data, logs, files, databases, or other customer application data | Germany / European Union for the currently used EU infrastructure | Only for customers or services whose data is processed through infrastructure operated by me on Hetzner, including selected customers for whom I provide self-hosted analytics |
For selected customer websites, I may provide privacy-focused analytics using a self-hosted instance of Umami running on Hetzner infrastructure. In those cases, Hetzner acts as a Subprocessor. Umami itself is self-hosted software and does not constitute a separate third-party recipient.
AI Processing Chain
For AI functionality, processing may involve more than one processor level.
For the Interview Service, the relevant processing chain is generally:
Customer → Franz Josef Drexler → OpenRouter, Inc. → selected AI model provider
The specific downstream AI model or infrastructure provider is selected by OpenRouter for each model request based on available endpoints and the applicable routing settings. No single downstream provider is therefore permanently designated.
Model requests are made with data_collection: deny. This permits only provider routes for which, according to the data policies maintained by OpenRouter, transmitted inputs and outputs are not used to train or improve the models. This is not a guarantee of complete zero-data retention; a selected provider may retain data for a limited period in particular to meet its security, abuse-prevention, or legal-retention requirements.
The available providers and endpoints, as well as their locations and data policies, may change. Current information is available in the directories maintained by OpenRouter:
- OpenRouter Providers and Endpoints
- OpenRouter Data Retention and Provider Policies
- OpenRouter Authorized Subprocessors
The provider used for an individual request can be established from the routing or generation metadata made available by OpenRouter.
OpenRouter and the selected AI model provider may themselves use additional subprocessors for infrastructure and service delivery.
Current information about further subprocessors is available from the respective providers:
Where a downstream provider acts as a further processor, the same data protection obligations that apply between the Customer and Franz Josef Drexler under the DPA are imposed on it within the applicable processing chain.
International Transfers
Some Subprocessors process personal data outside the European Economic Area, in particular in the United States.
Where required by Chapter V GDPR, international transfers are based on an applicable adequacy decision, including the EU-US Data Privacy Framework where applicable, or on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and any supplementary measures required in the specific circumstances.
The processing locations shown above indicate the principal or relevant locations and do not necessarily identify every location from which a provider or its authorised subprocessors may technically process data.
Customer-Contracted Providers
A provider is generally not my Subprocessor where:
- the customer contracts directly with the provider;
- the relevant account belongs to the customer; and
- I merely configure, deploy to, or administer that account on the customer’s instructions.
This may apply, for example, where I help a customer set up or manage their own:
- Cloudflare account;
- hosting or cloud account;
- CMS;
- contact-form provider;
- analytics service;
- storage service;
- database or backend service.
In such cases, the relevant provider generally forms part of the customer’s own processor relationship.
Any access by me to personal data within such an account remains governed by my DPA with the customer where I act as processor.
Changes to Subprocessors
I may add or replace Subprocessors where necessary to provide the services.
Affected customers will generally be informed at least 14 days before a new or replacement Subprocessor begins processing their personal data, in accordance with the DPA.
A shorter notice period may apply where necessary for urgent security reasons, legal requirements, an unexpected discontinuation by an existing provider, or comparable circumstances outside my reasonable control.
Customers may object to a new or replacement Subprocessor on reasonable data protection grounds in accordance with the DPA.
Contact
Questions about this list or a particular processing chain can be sent to: