This is a convenience translation. The German version is the legally binding one.
Service providers
Service providers and recipients of personal data engaged by HexRead (HexWorld Solutions GmbH) to operate the service. Most act as our data processors (Art. 28 GDPR); payment providers such as Stripe process payment data partly under their own responsibility. All locations are in the EU/EEA, or a documented transfer safeguard is in place (Art. 44 ff. GDPR). Last reviewed: 2026-07-13.
| Provider | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Scaleway SAS | EU cloud infrastructure — compute (incl. GPU), object storage, databases, and queues. All document processing and platform operations run on this infrastructure. | France (Paris, fr-par-2) (EU/EEA) | None required (processing exclusively in the EU/EEA). |
| Stripe Payments Europe, Ltd. | Subscription billing, payment processing (cards + SEPA Direct Debit), and VAT calculation (Stripe Tax). HexWorld is the merchant of record. Stripe receives account, billing, and payment data only — never document content. | Ireland (EU/EEA) | Onward transfer to Stripe, Inc. (USA) for parts of the payment processing under EU Standard Contractual Clauses (SCC) and the EU-US Data Privacy Framework (DPF). |
| Scaleway S.A.S. (Transactional Email / TEM) | Delivery of transactional email — sign-in one-time codes (OTP), security and account notifications, billing receipts; no marketing. Same legal entity as the infrastructure entry above. | France (Paris, fr-par) (EU/EEA) | None required (processing exclusively in the EU/EEA). |
| mailbox.org (Heinlein Hosting GmbH) | Business email mailboxes — receiving and answering messages sent to our published contact addresses (privacy, support, security, and sales enquiries). | Germany (Berlin) (EU/EEA) | None required (processing exclusively in the EU/EEA). |
Self-hosted — no external providers
- Zitadel (identity management) — Software operated by HexWorld itself on Scaleway (EU) — not an external provider. The underlying infrastructure is Scaleway (listed above).
- Disposable-email domain blocklist — A static, locally bundled domain list used to reject disposable email addresses at sign-up. No external service is called at runtime; no data leaves our systems.
- ALTCHA (proof-of-work challenge) — Self-hosted protection against automated sign-ups on the login page — no third-party verification service, no cookies. No data is transmitted to third parties; the conversion path is unaffected.
Changes
We review this list regularly and update it whenever providers are added, replaced, or removed. The version published here is authoritative and is kept consistent with the records of processing activities (recipients).