Legal
Subprocessors
List of the subprocessors FluxonLab engages to operate Saldek (Art. 28 GDPR).
Last updated: 10 October 2026
This translation is provided for information only. Only the German version is legally binding. Read the German original
1. Principles of data processing
Saldek runs on servers of Hetzner Online GmbH in Germany; the databases and the accounting data are stored there. Document files are stored in the audit-proof archive at Amazon Web Services in the Frankfurt am Main region (Germany), and the encrypted backups of the databases in a separate storage at Amazon Web Services in the European Union.
In the "Standard" mode (the default), Saldek uses the AI services of OpenAI and TypeSafe; if OpenAI does not read a document or reads it with nothing usable, a model from Google reads it instead. OpenAI and Google read the documents; for this, the image of each page and the document text are transmitted (for XML e-invoices and CSV files only the text). OpenAI also gives assessments from the first page of a document (such as the document type or a "paid" mark). TypeSafe assesses the documents read (such as the document type, the invoice recipient and the link to earlier documents), proposes the booking, matches imported bank transactions to documents and checks for duplicates; for this, details and text extracts of the document as well as booking details and bank transactions are transmitted. In booking details and bank transactions, IBANs, e-mail addresses and phone numbers are masked beforehand. The services process the data in the USA, Google also in other countries in which it operates data centres, and keep it only for a limited time (see the privacy policy). The transfer to TypeSafe is based on the EU standard contractual clauses (Art. 46(2)(c) GDPR), the transfer to Google on the EU-US Data Privacy Framework (Art. 45 GDPR), otherwise also on the EU standard contractual clauses; the clauses are part of the contracts linked below. OpenAI Ireland Ltd transfers the data to affiliates in the USA on the basis of agreements containing the EU standard contractual clauses (OpenAI's Data Processing Addendum, section 4.1). In the "Without AI" mode, which can be selected in the organisation's settings, no data is transmitted to AI services.
In "Standard" mode, voice notes and voice input in "Ask Saldek" are converted to text by Microsoft's service (Azure Speech in the North Europe region in Ireland); OpenAI replaces it (processing by affiliates of OpenAI in the USA) when it does not respond, does not respond in time or cannot process the recording. Microsoft receives only the recording, OpenAI also a recognition aid with accounting terms and supplier names; Saldek does not store the recording after the conversion.
Saldek sends technical error reports of the application to Sentry (Functional Software, Inc.); they are stored in Sentry's EU data region in Frankfurt am Main. An error report contains the type of error, the affected program location and the page address without parameters, but no document data, request contents or user identifiers; e-mail addresses, IBANs and VAT IDs are masked before sending.
Customer documents, receipts and financial transaction data are not used to train AI models — neither by Saldek nor, under their contract terms, by TypeSafe, OpenAI, Google or Microsoft.
2. Current list of sub-processors
When a Google account is connected (Google Drive, Gmail mailbox), Google acts as an independent controller, not as a processor; the entry is listed for transparency.
| Company | Purpose | Location | Third-country transfer | Contract |
|---|---|---|---|---|
| Hetzner Online GmbH | Hosting of the application: web app, interfaces, database and document processing | Germany | No transfer to a third country | Data processing agreement under Art. 28 GDPR |
| Amazon Web Services EMEA SARL, Luxembourg | Storage of the document files in the audit-proof archive (S3 Object Lock) for the seven-year retention under § 132 BAO, and of the encrypted database backups in a separate storage | Germany (AWS region Frankfurt am Main) for the document files; the backups in an AWS region in the EU | No transfer to a third country planned; for the exceptional case, the AWS Data Processing Addendum contains the EU standard contractual clauses (SCCs) | AWS Data Processing Addendum (part of the AWS Service Terms) |
| TypeSafe AI, Inc., San Francisco (model “Jev”) | Assessments of documents read (such as the document type, the invoice recipient and the link to earlier documents), booking proposals (category, account, tax code), matching imported bank transactions to documents, checking for duplicates and selecting matching sources for questions in “Ask Saldek”. What is transmitted is details and text extracts of the document and booking details and bank transactions (business partner, payment reference, reference, amount); in booking details and bank transactions, IBANs, e-mail addresses and phone numbers are masked beforehand. Not in the “Without AI” mode. | USA | EU standard contractual clauses (SCCs) in TypeSafe’s Data Processing Agreement | TypeSafe’s Data Processing Agreement (part of the Master Customer Agreement) |
| OpenAI Ireland Ltd, Dublin (model “gpt-6-luna”) | Reading the documents (the image of each page and the document text are transmitted, for XML e-invoices and CSV files only the text), assessments from the first page of a document (such as the document type, a “paid” mark or, for sole traders and freelancers, whether a purchase is for the business; the image of the first page and, where applicable, the beginning of the document text are transmitted) and answering questions in “Ask Saldek” (the question, the earlier questions of the conversation and matching extracts from documents and entries, in which IBANs, e-mail addresses and phone numbers are masked). Not in the “Without AI” mode. | USA (processing by affiliates of OpenAI) | OpenAI Ireland Ltd transfers the data to affiliates in the USA on the basis of agreements containing the EU standard contractual clauses (SCCs) (OpenAI’s Data Processing Addendum, section 4.1) | OpenAI’s Data Processing Addendum (part of the OpenAI Services Agreement) |
| Google Cloud EMEA Limited, Dublin (model “gemini-3.5-flash-lite”) | Reading a document instead of OpenAI when OpenAI does not read it or reads it with nothing usable (the same data as for OpenAI is transmitted). Not in the “Without AI” mode. | USA and other countries in which Google operates data centres | EU-US Data Privacy Framework (Google’s certification), otherwise EU standard contractual clauses (SCCs) in Google’s Data Processing Addendum | Data Processing Addendum for Products Where Google is a Data Processor (part of the Gemini API Additional Terms of Service) |
| Microsoft Ireland Operations Limited, Dublin (Azure Speech, model “MAI-Transcribe-2”) | Converting voice notes and voice input to text (microphone in “Ask Saldek”; WhatsApp voice messages only once the WhatsApp connection is in operation). Only the recording is transmitted. Not in the “Without AI” mode. | Ireland (Azure region North Europe) | No transfer to a third country planned; for the exceptional case, Microsoft’s Data Protection Addendum contains the EU standard contractual clauses (SCCs) | Microsoft Products and Services Data Protection Addendum |
| OpenAI Ireland Ltd, Dublin (model “gpt-transcribe”) | Converting voice notes and voice input to text when Microsoft’s service does not respond, does not respond in time or cannot process the recording. Transmitted are the recording and, as a recognition aid, a fixed accounting vocabulary and the names of up to 30 of the organisation’s suppliers. Not in the “Without AI” mode. | USA (processing by affiliates of OpenAI) | OpenAI Ireland Ltd transfers the data to affiliates in the USA on the basis of agreements containing the EU standard contractual clauses (SCCs) (OpenAI’s Data Processing Addendum, section 4.1) | OpenAI’s Data Processing Addendum (part of the OpenAI Services Agreement) |
| Stripe Payments Europe, Ltd. | Billing of subscriptions: payment processing and invoicing of the software fees. Stripe only receives the customer’s billing data, no documents and no accounting data; for its own purposes such as fraud prevention and compliance with legal obligations, Stripe is itself a controller. | Ireland (EU); disclosure to Stripe, Inc. (USA) possible | EU-US Data Privacy Framework, otherwise EU standard contractual clauses (SCCs), under the data transfer addendum to the Stripe Data Processing Agreement | Stripe Data Processing Agreement (part of the Stripe Services Agreement) |
| Functional Software, Inc. (Sentry), San Francisco | Error monitoring: technical error reports of the web app, the interfaces and document processing (type of error, affected program location, page address without parameters, browser and system version, event ID), so that faults are detected and fixed. Document data, form and request contents, cookies and user identifiers are not transmitted; e-mail addresses, IBANs and VAT IDs are masked before sending. The IP address is not stored. | Germany (Sentry’s EU data region, Frankfurt am Main); administrative data and access by Sentry also in the USA | EU-US Data Privacy Framework, otherwise EU standard contractual clauses (SCCs) in Sentry’s Data Processing Addendum | Sentry Data Processing Addendum (part of the Sentry Terms of Service) |
| Plus Five Five, Inc., San Francisco (Resend) | Sending the service’s e-mails from no-reply@saldek.eu (confirmation of the e-mail address, password reset, notice of a password change, invitations, confirmation codes to sender addresses of the e-mail document intake, confirmation that an organisation has been closed or deleted, invoices that customers send from the service to their customers, with the organisation’s e-mail address as the reply-to address) and receiving the contact addresses hello@saldek.eu and support@saldek.eu, whose messages are forwarded to the company’s contact address. What is transmitted is the recipient address and the content of the message, for invoices also, where applicable, a further address in copy (CC) that the user enters and the invoice as a PDF attachment, for contact messages the sender, subject, text and attachments. According to Resend, it keeps e-mail contents, metadata and logs for 30 days. | USA (according to Resend, all data is stored in the USA, including message contents and attachments, metadata, logs and account data; the Ireland region only determines the sending route) | EU standard contractual clauses (SCCs, modules two and three) in Resend’s Data Processing Addendum; according to Resend, it also participates in the EU-US Data Privacy Framework | Resend’s Data Processing Addendum (part of the Terms of Service) |
| Mailgun Technologies, Inc. (Mailgun EU) | Receiving the e-mails to the organisations’ intake addresses under in.saldek.eu (e-mail document intake) and forwarding them to the service. The sender, recipient, subject, text and attachments of the e-mail are processed. According to Mailgun, it keeps e-mail contents for up to seven days and event logs for the period its plan provides (one day on our current plan), and also uses the data as an independent controller where necessary to operate its e-mail service (for example to prevent spam and fraud, for the security and maintenance of its network and to meet legal obligations). | Mailgun’s EU region (data centres in Germany and Belgium); access for support and operations also from the USA | EU-US Data Privacy Framework (certification of Mailgun Technologies, Inc.), otherwise EU standard contractual clauses (SCCs, modules two and three) in Sinch’s Data Processing Agreement | Sinch’s Data Processing Agreement (part of the Sinch Email Terms of Service, section 4.3) |
| Google LLC, Mountain View (Google account: Google Drive and Gmail mailbox) | When a member connects their Google account: sign-in with Google, file selection in Google Drive and retrieval of the selected files, sending invoices through the connected Gmail mailbox and, only with the additional read permission, searching that mailbox for invoices and documents and importing them, each through Google’s interfaces. What is transmitted to Google is the requests to these interfaces and, when sending, the e-mail with the invoice. Google acts as an independent controller, not as a processor; the data in the Google account is governed by the user’s agreements with Google. | USA and other countries in which Google operates data centres | EU-US Data Privacy Framework (Google’s certification), otherwise EU standard contractual clauses (SCCs) in the Google Controller-Controller Data Protection Terms | Google Controller-Controller Data Protection Terms (part of the Google APIs Terms of Service) |
3. Planned sub-processors (not yet in use)
These services are planned and not yet in use. They receive data only once Saldek switches the respective function on and a member uses it for their organisation. Customers are informed under section 4 before they go into operation. For the Gmail add-on, Google acts as an independent controller, not as a processor; the entry is listed for transparency.
| Company | Purpose | Location | Third-country transfer | Contract |
|---|---|---|---|---|
| Meta Platforms Ireland Limited, Dublin (WhatsApp Business Platform Cloud API) | Document intake via WhatsApp through the service’s own WhatsApp number (the company’s WhatsApp Business account): receiving the photos and PDF files that members send after linking their phone number, and sending the replies (for example confirmation of the link or of receipt). What is transmitted is the sender’s phone number and WhatsApp ID, messages and files. According to Meta, it keeps messages for at most 30 days and also uses the data as an independent controller for the security and integrity of the service. Only in use once the function is switched on. | Data centres of Meta and its sub-processors in Ireland, Denmark, Sweden and the USA | Meta Platforms Ireland Limited is established in the EU; for transfers to affiliates such as Meta Platforms, Inc. (USA), Meta relies on the transfer mechanisms provided for by the GDPR (Meta Global Processor Terms); according to its own statements, Meta Platforms, Inc. participates in the EU-US Data Privacy Framework | Data Processing Terms (Exhibit A to the WhatsApp Business Platform Cloud API Terms) with the Meta Global Processor Terms |
| Google LLC, Mountain View (Gmail add-on) | Display of the Gmail add-on and retrieval of the attachments of the open e-mail through Google’s interfaces when a member sends them to the service. What is transmitted to Google is the contents of the add-on (name of the organisation, status of the link, file names of the attachments). Google acts as an independent controller, not as a processor; the data in the Google account is governed by the user’s agreements with Google. Only in use once the function is switched on. | USA and other countries in which Google operates data centres | EU-US Data Privacy Framework (Google’s certification), otherwise EU standard contractual clauses (SCCs) in the Google Controller-Controller Data Protection Terms | Google Controller-Controller Data Protection Terms (part of the Google APIs Terms of Service) |
4. Notification of changes
Customers are informed of any planned addition or replacement of a sub-processor at least 14 days in advance by e-mail or in the application and have the right to object for good cause.