Sub-processors

Host Europe GmbH, Hansestraße 111, 51149 Köln, Deutschland

Purpose and scope

Operation of the server for application, API, database and website; data-centre services, connectivity, backups. Affects all customers; account, project and billing data reside in the database on this server.

Location

Germany

Basis

Data processing agreement under Art. 28 GDPR

Neue Medien Münnich, Inhaber René Münnich, Hauptstraße 68, 02742 Friedersdorf, Deutschland

Purpose and scope

Sending the application's e-mails (sign-in codes, invitations, confirmations, notifications) and our mailbox mail@klickdemo.com. Recipient address, name, subject and content of each message are transmitted.

Location

Germany

Basis

Data processing agreement under Art. 28 GDPR

Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Irland

• Vertex AI (Anthropic Claude)
• Cloud Text-to-Speech (Chirp 3 HD)
• Cloud Run Jobs
• Secret Manager
• Artifact Registry

Purpose and scope

Vertex AI (primary route of AI processing once the quota is approved, currently not in use): language models of the Claude model family (Anthropic) for exploration, script, translation, summarising knowledge sources and review; Cloud Text-to-Speech: narrator voices; Cloud Run: execution of recording and rendering jobs; Secret Manager and Artifact Registry for operating the jobs. Inputs and outputs are not used for training and are not stored permanently after processing; when used through Vertex AI, Anthropic, PBC has no access under Google's commitments. Affects every project in which a run is started. Credentials never reach these services. Text-to-Speech receives only the texts to be spoken and the voice settings.

Location

Vertex AI and Cloud Run: regions in the European Union; Text-to-Speech: EU endpoint (storage and processing within Europe according to Google) third country

Basis

Google Cloud Data Processing Addendum (Art. 28 GDPR); for possible access from the USA, standard contractual clauses (Art. 46(2)(c) GDPR) and certification of Google LLC under the EU-US Data Privacy Framework (Art. 45 GDPR)

Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland

• Claude API (currently the only route of language-model processing; fallback once Vertex AI is approved)

Purpose and scope

Claude API, currently the only route (while the quota requested for Vertex AI has not been approved) and afterwards as a fallback (when Vertex AI is unavailable): language models of the Claude model family for exploration from screenshots and page structure, summarising knowledge sources, drafting scripts and plans, translation and text checks. The contracting party is Anthropic Ireland, Limited; processing is carried out by its affiliate Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA. Anthropic may not train models on content from the use of its services; inputs and outputs are retained at Anthropic for up to 30 days for abuse and safety review and deleted afterwards. Excepted are inputs and outputs that Anthropic's automated systems flag as violating its Usage Policy: they are retained for up to two years and the classification scores for up to seven years. Anthropic also retains data where required by law. Affects every project in which a run is processed through this route (currently every run with a language model). Transmitted are page texts and page structures (credentials and typical sensitive patterns such as e-mail addresses, IBANs and card numbers replaced with placeholders), screenshots (these details and everything the customer's redaction rules match blacked out), project description, notes, notes for revising the script, script, brand rules, pronunciation dictionary, structure, formulas and texts of spreadsheet files (numbers replaced by their kind) and texts of additional knowledge sources. Credentials and files as such never reach the service.

Location

United States (third country; processing by Anthropic, PBC) third country

Basis

Anthropic Commercial Terms with the incorporated Data Processing Addendum (Art. 28 GDPR); standard contractual clauses from the Data Processing Addendum (Art. 46(2)(c) GDPR); no EU-US Data Privacy Framework

Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA (Cloudflare Germany GmbH, Rosental 7, 80331 München, als europäischer Ansprechpartner)

• R2 (jurisdiction EU)
• CDN delivery of videos and player
• Turnstile
• DNS
• Email Routing

Purpose and scope

Object storage R2 for videos, screenshots, audio files, uploaded files and documents ("EU" jurisdiction, storage in the EU only); delivery of released videos and the embed player through the Cloudflare network; Turnstile to protect the teaser form; DNS of the domains klickdemo.com and klickdemo-mail.com; Email Routing: receipt of e-mails to the project mail addresses (sign-in codes and invitations from the recorded software), which are forwarded immediately to our server and not stored at Cloudflare. Affects all customers. During delivery the Cloudflare location closest to the viewer processes the viewer's IP address; storage is in the EU only. When receiving mail, Cloudflare processes sender, recipient and content of the message only for forwarding; the Email Routing activity log contains sender, recipient, time and delivery status.

Location

Storage: European Union; delivery and mail receipt: Cloudflare network (location near the viewer or the sending server) third country

Basis

Cloudflare Data Processing Addendum (Art. 28 GDPR); standard contractual clauses (Art. 46(2)(c) GDPR) and certification of Cloudflare, Inc. under the EU-US Data Privacy Framework (Art. 45 GDPR)

Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Irland

• Checkout
• Billing
• Tax
• Customer Portal
• Connect

Purpose and scope

Payment processing, invoicing, tax calculation, customer portal, partner payouts. For payment processing Stripe acts as an independent controller, for invoicing as a processor. Affects only the customer's own contract and payment data (name, company, billing address, e-mail address, VAT ID), no project data.

Location

Ireland; transfer to Stripe, Inc. (USA) possible third country

Basis

Stripe Data Processing Agreement (Art. 28 GDPR); standard contractual clauses (Art. 46(2)(c) GDPR) and certification of Stripe, Inc. under the EU-US Data Privacy Framework (Art. 45 GDPR)