List of Subprocessors
List of Subprocessors
This page names the subprocessors Silverfriend GmbH engages in connection with the phone-companion service. The list is provided for transparency under Art. 28 GDPR and complements our Privacy Policy. The German Liste der Auftragsverarbeiter is the legally binding original; this English version is a courtesy translation.
As of: 24 August 2026
Version: 1.2
1. Controller
Silverfriend GmbH
Döringstraße 6, 10245 Berlin, Germany
Email: datenschutz@silverfriend.de
2. Overview
Every subprocessor listed below is bound by a data-processing agreement under Art. 28 GDPR. Where processing in third countries is unavoidable, it is covered by the EU Standard Contractual Clauses (Module 2, June 2021) together with supplementary technical measures (encryption with customer-managed keys, TLS 1.2+, EU data residency, logging).
3. Current subprocessors
| Role | Entity | Location | Data categories | Legal instrument |
|---|---|---|---|---|
| Cloud hosting and data processing (hosting, database, speech model) | Amazon Web Services EMEA SARL | 38 Avenue John F. Kennedy, L-1855 Luxembourg (EU data centres: Germany, Sweden); US parent: Amazon.com, Inc. | Account data, voice recording (short-term), transcript, memory notes, life chronicle, call metadata | Art. 28 GDPR DPA + EU Standard Contractual Clauses (Module 2) |
| Telephony (inbound and outbound calls) | Twilio Ireland Limited | 25-28 North Wall Quay, Dublin 1, Ireland; US parent: Twilio Inc. | Phone number, call timestamp, call status, voice stream during the call | Art. 28 GDPR DPA + EU Standard Contractual Clauses (Module 2) |
| Push notifications (app) | Google Ireland Limited (Firebase Cloud Messaging) | Gordon House, Barrow Street, Dublin 4, Ireland; US parent: Google LLC | Push token (device identifier), notification type (no content in payload) | Art. 28 GDPR DPA + EU Standard Contractual Clauses (Module 2) |
| Website reach measurement and tag management — only after statistics or marketing consent | Google Ireland Limited (Google Analytics 4, Google Tag Manager) | Gordon House, Barrow Street, Dublin 4, Ireland; US parent: Google LLC | Pseudonymous visit cookies (_ga, _ga_*), truncated IP address, user agent, URL visited, page and event data. Before consent, only cookieless aggregated signals with no user reference are transmitted (Consent Mode v2, default denied). | DPA under Art. 28 GDPR (Google Ads Data Processing Terms) + EU SCCs (Module 2) + EU-US Data Privacy Framework |
| App usage analytics — only after in-app consent | PostHog, Inc. | USA; processing and storage exclusively in the EU (Frankfurt am Main, AWS region eu-central-1) | Pseudonymous user ID, screens viewed, feature events, device model, OS and app version, language. No call content, no names, no phone numbers, no free text, no location data. | DPA under Art. 28 GDPR + EU SCCs (Module 2) + EU-US Data Privacy Framework |
| App crash reports — only after in-app consent | Google Ireland Limited (Firebase Crashlytics) | Gordon House, Barrow Street, Dublin 4, Ireland; US parent: Google LLC | Technical error report, time of crash, device model, OS and app version, language, subscription status, pseudonymous user ID. No call content and no plaintext personal data. | DPA under Art. 28 GDPR + EU SCCs (Module 2) + EU-US Data Privacy Framework |
| Marketing, website tracking, and CRM (caregiver data only) | HubSpot Ireland Limited | 2nd Floor 30 North Wall Quay, Dublin 1, Ireland; US parent: HubSpot, Inc. | Contact data (name, email, phone), form submissions, UTM and campaign parameters, pseudonymous visitor cookie | Art. 28 GDPR DPA + EU Standard Contractual Clauses (Module 2) |
| Advertising tracking and conversion measurement (Facebook/Instagram) — only after marketing consent | Meta Platforms Ireland Ltd. | 4 Grand Canal Square, Dublin 2, Ireland; US parent: Meta Platforms, Inc. | Pseudonymous visitor cookies (_fbp, _fbc), truncated IP address, user agent, visited URL, click and conversion events | Art. 28 GDPR DPA + EU Standard Contractual Clauses (Module 2) + EU-US Data Privacy Framework |
| Subscription management (if enabled) | RevenueCat, Inc. | 333 Bush Street, San Francisco, CA 94104, USA | Subscription status, purchase transaction IDs (no payment data) | Art. 28 GDPR DPA + EU Standard Contractual Clauses (Module 2) |
| Tax advice and bookkeeping | Tax advisory firm in Germany (to be named) | Germany | Invoices and payment records within statutory retention periods | Art. 28 GDPR DPA |
4. Third-country transfers
Primary processing happens inside the European Union. Where US parent companies of the listed providers receive access for administrative control, the EU-US Data Privacy Framework applies to DPF-certified recipients, and the EU Standard Contractual Clauses apply in addition. A current Transfer Impact Assessment (TIA) is available from the Data Protection Officer on request.
5. Changes to this list
For material changes (new subprocessor, replacement of an existing one) we inform active subscribers at least 14 days before the change takes effect by email or in-app banner. A change log appears at the end of this page once changes occur.
6. Change history
| Date | Version | Material changes |
|---|---|---|
| 2026-04-14 | 1.0 | Initial publication (pre-launch) |
| 2026-05-08 | 1.1 | Added Meta Platforms Ireland Ltd. (Meta Pixel — Facebook/Instagram advertising) as a subprocessor; processing only after marketing consent |
| 2026-08-24 | 1.2 | Added three subprocessors: Google Ireland Limited (Google Analytics 4 and Google Tag Manager — website reach measurement, consent-gated), PostHog, Inc. (mobile-app usage analytics, stored in the EU in Frankfurt, consent-gated) and Google Ireland Limited (Firebase Crashlytics — app crash reports, consent-gated). The app has included PostHog and Crashlytics since July 2026; since app version 1.5.0 both hang off the same consent and are switched off before it is given. |
As of 24 August 2026 · Silverfriend GmbH · datenschutz@silverfriend.de