List of Subprocessors
List of Subprocessors
This page names the subprocessors Silverfriend GmbH engages in connection with the phone-companion service. The list is provided for transparency under Art. 28 GDPR and complements our Privacy Policy. The German Liste der Auftragsverarbeiter is the legally binding original; this English version is a courtesy translation.
As of: 14 April 2026
Version: 1.0
1. Controller
Silverfriend GmbH
Döringstraße 6, 10245 Berlin, Germany
Email: datenschutz@silverfriend.de
2. Overview
Every subprocessor listed below is bound by a data-processing agreement under Art. 28 GDPR. Where processing in third countries is unavoidable, it is covered by the EU Standard Contractual Clauses (Module 2, June 2021) together with supplementary technical measures (encryption with customer-managed keys, TLS 1.2+, EU data residency, logging).
3. Current subprocessors
| Role | Entity | Location | Data categories | Legal instrument |
|---|---|---|---|---|
| Cloud hosting and data processing (hosting, database, speech model) | Amazon Web Services EMEA SARL | 38 Avenue John F. Kennedy, L-1855 Luxembourg (EU data centres: Germany, Sweden); US parent: Amazon.com, Inc. | Account data, voice recording (short-term), transcript, memory notes, life chronicle, call metadata | Art. 28 GDPR DPA + EU Standard Contractual Clauses (Module 2) |
| Telephony (inbound and outbound calls) | Twilio Ireland Limited | 25-28 North Wall Quay, Dublin 1, Ireland; US parent: Twilio Inc. | Phone number, call timestamp, call status, voice stream during the call | Art. 28 GDPR DPA + EU Standard Contractual Clauses (Module 2) |
| Push notifications (app) | Google Ireland Limited (Firebase Cloud Messaging) | Gordon House, Barrow Street, Dublin 4, Ireland; US parent: Google LLC | Push token (device identifier), notification type (no content in payload) | Art. 28 GDPR DPA + EU Standard Contractual Clauses (Module 2) |
| Marketing, website tracking, and CRM (caregiver data only) | HubSpot Ireland Limited | 2nd Floor 30 North Wall Quay, Dublin 1, Ireland; US parent: HubSpot, Inc. | Contact data (name, email, phone), form submissions, UTM and campaign parameters, pseudonymous visitor cookie | Art. 28 GDPR DPA + EU Standard Contractual Clauses (Module 2) |
| Subscription management (if enabled) | RevenueCat, Inc. | 333 Bush Street, San Francisco, CA 94104, USA | Subscription status, purchase transaction IDs (no payment data) | Art. 28 GDPR DPA + EU Standard Contractual Clauses (Module 2) |
| Tax advice and bookkeeping | Tax advisory firm in Germany (to be named) | Germany | Invoices and payment records within statutory retention periods | Art. 28 GDPR DPA |
4. Third-country transfers
Primary processing happens inside the European Union. Where US parent companies of the listed providers receive access for administrative control, the EU-US Data Privacy Framework applies to DPF-certified recipients, and the EU Standard Contractual Clauses apply in addition. A current Transfer Impact Assessment (TIA) is available from the Data Protection Officer on request.
5. Changes to this list
For material changes (new subprocessor, replacement of an existing one) we inform active subscribers at least 14 days before the change takes effect by email or in-app banner. A change log appears at the end of this page once changes occur.
6. Change history
| Date | Version | Material changes |
|---|---|---|
| 2026-04-14 | 1.0 | Initial publication (pre-launch) |
As of 14 April 2026 · Silverfriend GmbH · datenschutz@silverfriend.de