UF Online — Sub-processor List
This is the single place we name the third parties that may process personal data on our behalf (required by GDPR Art. 28(4)); our Privacy Policy and DPA reference it. We give prior notice before adding or replacing a sub-processor so customers can object (DPA §4). Operated by DaemonForge Development.
Last updated: 7 July 2026
Sub-processors
| Sub-processor | Purpose | Location | Transfer basis (EEA/UK → ) |
|---|---|---|---|
| Vultr (The Constant Company, LLC) | Cloud hosting / compute / storage | US company; EU regions (Amsterdam/Frankfurt/Paris) + data residency | SCCs + EU data residency |
| OVHcloud | Cloud hosting (EU) | France / EU | Intra-EEA (no restricted transfer); SCCs for any onward transfer |
| Cloudflare, Inc. | Edge / CDN / WAF / DNS / R2 storage / Workers AI gateway | US company; EU edge | EU-US DPF (active) + SCCs fallback |
| Stripe, Inc. | Payment processing & tax | US + EU entities | EU-US DPF + SCCs |
| OpenAI | AI (LLM) inference | US | EU-US DPF + SCCs |
| Anthropic | AI (LLM) inference | US | EU-US DPF + SCCs |
| ElevenLabs (if voice enabled) | AI text-to-speech | US | EU-US DPF + SCCs |
| Replicate / Fal (if OSS voice/GPU enabled) | Serverless GPU inference | US | SCCs (obtain signed DPA before sending identifiable data) |
| Discord (if Discord features / social login used) | OAuth linking / bot integration | US | EU-US DPF + SCCs; only OAuth identifiers flow |
| Google (if Google sign-in used) | Social sign-in | US | EU-US DPF + SCCs; account identifiers only |
Notes
- AI providers receive only the content the relevant AI feature sends (not your whole dataset), and per our DPA §6 we do not permit training on it.
- For social sign-in and Discord, only limited identifiers are shared.
- Each provider's acceptable-use / data-processing terms apply to your use of those features (ToS §16 pass-through).