List of Subprocessors

This page names the subprocessors Silverfriend GmbH engages for SilverFriend, our AI companion by phone. The list is provided for transparency under Art. 28 GDPR and complements our Privacy Policy. The German Liste der Auftragsverarbeiter is the legally binding original; this English version is a courtesy translation.

As of: 5 October 2026
Version: 1.6

1. Controller

Silverfriend GmbH
Döringstraße 6, 10245 Berlin, Germany
Email: datenschutz@silverfriend.de

2. Overview

Every subprocessor listed below is bound by a data-processing agreement under Art. 28 GDPR. Where processing in third countries is unavoidable, it is covered by the EU Standard Contractual Clauses (Module 2, June 2021) together with supplementary technical measures (encryption with customer-managed keys, TLS 1.2+, EU data residency, logging).

3. Current subprocessors

Role	Entity	Location	Data categories	Legal instrument
Cloud hosting and data processing (hosting, database, speech model)	Amazon Web Services EMEA SARL	38 Avenue John F. Kennedy, L-1855 Luxembourg (EU data centres: Germany and the Nordics; storage exclusively in Germany); US parent: Amazon.com, Inc.	Account data, real-time voice processing; written call record (14 days), memory notes, life chronicle, call metadata; questions to the AI companion for events on the website (free text and filters — not stored; technical log without wording 90 days)	Art. 28 GDPR DPA + EU Standard Contractual Clauses (Module 2)
Telephony (inbound and outbound calls)	Twilio Ireland Limited	25-28 North Wall Quay, Dublin 1, Ireland; US parent: Twilio Inc.	Phone number, call timestamp, call status, voice stream during the call (not stored)	Art. 28 GDPR DPA + EU Standard Contractual Clauses (Module 2)
Push notifications (app)	Google Ireland Limited (Firebase Cloud Messaging)	Gordon House, Barrow Street, Dublin 4, Ireland; US parent: Google LLC	Push token (device identifier), notification type (no content in payload)	Art. 28 GDPR DPA + EU Standard Contractual Clauses (Module 2)
Website reach measurement and tag management — only after statistics or marketing consent	Google Ireland Limited (Google Analytics 4, Google Tag Manager)	Gordon House, Barrow Street, Dublin 4, Ireland; US parent: Google LLC	Pseudonymous visit cookies (`_ga`, `_ga_*`), user agent, URL visited, page and event data. Before any consent and after "Essential only", nothing is sent to Google; Google Analytics and Google Tag Manager load only after consent. Page addresses are sent without campaign or other parameters; according to Google, for visits from the EU the IP address is used only to derive an approximate location and is not stored.	DPA under Art. 28 GDPR (Google Ads Data Processing Terms) + EU SCCs (Module 2) + EU-US Data Privacy Framework
App usage analytics — only after in-app consent	PostHog, Inc.	USA; processing and storage exclusively in the EU (Germany)	Pseudonymous user ID, screens viewed, feature events, device model, OS and app version, language. No call content, no names, no phone numbers, no free text, no location data.	DPA under Art. 28 GDPR + EU SCCs (Module 2) + EU-US Data Privacy Framework
App crash reports — only after in-app consent	Google Ireland Limited (Firebase Crashlytics)	Gordon House, Barrow Street, Dublin 4, Ireland; US parent: Google LLC	Technical error report, time of crash, device model, OS and app version, language, subscription status, pseudonymous user ID. No call content and no plaintext personal data.	DPA under Art. 28 GDPR + EU SCCs (Module 2) + EU-US Data Privacy Framework
Blog delivery, waiting list, subscriber CRM, email communication, and website tracking — website tracking only after marketing consent (caregiver data only)	HubSpot Ireland Limited	2nd Floor 30 North Wall Quay, Dublin 1, Ireland; US parent: HubSpot, Inc.	Contact data (name, email, phone), form submissions, UTM and campaign parameters, pseudonymous visitor cookie	Art. 28 GDPR DPA + EU Standard Contractual Clauses (Module 2)
Advertising tracking and conversion measurement (Facebook/Instagram) — only after marketing consent	Meta Platforms Ireland Ltd.	4 Grand Canal Square, Dublin 2, Ireland; US parent: Meta Platforms, Inc.	Pseudonymous visitor cookies (`_fbp`, `_fbc`), IP address, user agent, page visited (no personal information in the address), click and conversion events	Not a processor: we are jointly responsible with Meta for the collection and transmission through the pixel (Art. 26 GDPR; controller addendum in Meta's Business Tools Terms); Meta alone is responsible for its further processing. Transfer to the USA: EU-US Data Privacy Framework and the EU Standard Contractual Clauses provided by Meta
Subscription management (if enabled)	RevenueCat, Inc.	333 Bush Street, San Francisco, CA 94104, USA	Subscription status, purchase transaction IDs (no payment data)	Art. 28 GDPR DPA + EU Standard Contractual Clauses (Module 2)
Tax advice and bookkeeping	Tax advisory firm in Germany (to be named)	Germany	Invoices and payment records within statutory retention periods	Art. 28 GDPR DPA

4. Third-country transfers

Primary processing happens inside the European Union. Where US parent companies of the listed providers receive access for administrative control, the EU-US Data Privacy Framework applies to DPF-certified recipients, and the EU Standard Contractual Clauses apply in addition. A current Transfer Impact Assessment (TIA) is available from the Data Protection Officer on request.

5. Changes to this list

For material changes (new subprocessor, replacement of an existing one) we inform active subscribers at least 14 days before the change takes effect by email or in-app banner. A change log appears at the end of this page once changes occur.

6. Change history

Date	Version	Material changes
2026-04-14	1.0	Initial publication (pre-launch)
2026-05-08	1.1	Added Meta Platforms Ireland Ltd. (Meta Pixel — Facebook/Instagram advertising) as a subprocessor; processing only after marketing consent
2026-08-24	1.2	Added three subprocessors: Google Ireland Limited (Google Analytics 4 and Google Tag Manager — website reach measurement, consent-gated), PostHog, Inc. (mobile-app usage analytics, stored in the EU in Frankfurt, consent-gated) and Google Ireland Limited (Firebase Crashlytics — app crash reports, consent-gated). The app has included PostHog and Crashlytics since July 2026; since app version 1.5.0 both hang off the same consent and are switched off before it is given.
2026-09-05	1.3	Corrected the description of voice processing: no audio recording of the regular calls is stored; the voice is processed in real time and what is stored is a written call record (14 days). Made explicit that the voice stream carried by Twilio is not stored. HubSpot's role made precise (blog delivery, waiting list, subscriber CRM, email communication, and the consent-gated website tracking); the website itself is not served by HubSpot. Storage location described consistently: servers in the European Union, storage exclusively in Germany.
2026-10-05	1.6	Meta entry aligned with privacy policy 2.6: joint responsibility instead of processing, full IP address, transfer basis without a module number.
2026-10-05	1.5	Google entry aligned with actual behaviour (nothing before consent, page address without parameters, IP address not stored); product name "AI companion by phone".
2026-09-10	1.4	AWS entry extended with the requests to the AI companion for events on the website (language model on Amazon Bedrock in EU data centres; no storage of question and answer)

As of 5 September 2026 · Silverfriend GmbH · datenschutz@silverfriend.de