Torsten Labs DOO · poolse
Subprocessors
The third parties that may process customer personal data, what each one does, and where it sits.
This is the list the Data Processing Addendum points at. Under Art. 28(2) and (4) GDPR we may engage subprocessors under your general written authorisation, provided we publish who they are, give you notice before adding one, and remain fully liable for their performance.
Current subprocessors
| Subprocessor | What it does for us | Data it can reach | Processing location | Transfer mechanism | In use since |
|---|---|---|---|---|---|
| Cloudflare, Inc.Customer content | Attachment object storage (R2), DNS, TLS termination, CDN, and denial-of-service protection for poolse endpoints. | Files and images your end users attach to messages; IP addresses and request metadata seen at the edge. | European Union (R2 EU jurisdiction restriction); global edge network for request routing | EU Standard Contractual Clauses + UK Addendum, incorporated by the Cloudflare Data Processing Addendum | 2026-08-19 |
| Oracle (Oracle Cloud Infrastructure)Customer content | Virtual server and block storage running the poolse application, database, background workers, and the call media server. | All data stored by the service. Message bodies, webhook secrets and push credentials are encrypted at rest under a per-tenant key held by poolse. Oracle provides the infrastructure only and does not access customer data in normal operation. | Germany — Oracle Cloud region eu-frankfurt-1 (Frankfurt am Main, EU) | Data stays in the EU region; EU Standard Contractual Clauses in the Oracle Services Data Processing Agreement for any support access from outside the EEA | 2026-10-26 |
| Apple Inc. (APNs) and Google LLC (Firebase Cloud Messaging)Customer content | Delivery of the push notifications your app receives from poolse: incoming-call rings, chat notifications, missed calls and read sync. Sent with the APNs key and Firebase service account you upload, under your own developer accounts. | Device push tokens and the notification payload, which can include the sender name, conversation name and a message preview, depending on your notification settings. | United States and global infrastructure | EU–U.S. Data Privacy Framework and EU Standard Contractual Clauses under Apple’s and Google’s developer terms | 2026-08-19 |
| Lemon Squeezy, LLCAccount & billing data | Merchant of Record for self-serve checkout: payment processing, fraud screening, sales-tax and VAT determination, invoicing, and refunds. Not yet live: while checkout is not open, paid plans are invoiced by Torsten Labs directly and Lemon Squeezy receives no data. | Billing name, email, billing address, country, tax identifiers, purchase history, and payment-method metadata. Full card numbers are handled by Lemon Squeezy and its PCI-DSS certified processors and never reach poolse systems. | United States, with processing by its own payment partners | EU Standard Contractual Clauses under the Lemon Squeezy Data Processing Addendum | 2026-08-19 |
| Resend, Inc.Account & billing data | Delivery of transactional email — address verification, password resets, security alerts, and replies to messages you send us. | Recipient email address, message subject and body, and delivery metadata. | United States and European Union | EU Standard Contractual Clauses under the Resend Data Processing Agreement | 2026-08-19 |
| Zoho Corporation B.V.Account & billing data | Email mailboxes for the addresses we publish (hello@, support@, sales@, billing@, security@, privacy@, legal@): the correspondence you and your users send us. | Sender name and email address, and whatever the email contains, including anything you choose to forward to us. | European Union (Zoho EU data centres) | Data stays in the EU data centres; EU Standard Contractual Clauses in the Zoho Data Processing Addendum for any access by Zoho group support outside the EEA | 2026-10-28 |
| Telegram FZ-LLCOperational metadata | Delivery of internal operational alerts to the poolse on-call channel (for example, a failed webhook delivery in the public demo). | Event metadata only — event type, tenant and conversation identifiers, timestamps. Message bodies are never included in an alert. | United Arab Emirates and global infrastructure | EU Standard Contractual Clauses; alerts are configured to exclude content and direct identifiers | 2026-08-19 |
Each entry is bound by a written contract imposing obligations no less protective than our DPA with you, is limited to the purpose stated, and was assessed on security and data protection before being engaged.
Other recipients
These are not subprocessors of customer content, but they are named because you should know every party that can end up holding data connected to your account.
| Recipient | Relationship and what they receive |
|---|---|
| Google LLC / GitHub, Inc. | Identity providers, only if you choose to sign in with Google or GitHub. They tell us your email address, name, and profile image; we tell them nothing about your poolse usage. Each acts as an independent controller for the sign-in itself. |
| Professional advisers and authorities | Accountants, auditors, and lawyers under a duty of confidentiality; and courts, tax authorities, or law-enforcement bodies where a legally binding request requires it. |
| A successor entity | If poolse or Torsten Labs is merged, acquired, or has assets transferred, data moves with the service. You will be told before any transfer changes who controls your data, and the receiving party stays bound by these commitments. |
Your own storage
If you connect your own storage bucket, attachments uploaded from then on are stored with the provider you chose, in your bucket. That provider is engaged by you, under your own agreement with it, and is not a poolse subprocessor. poolse holds the credentials you give it, encrypted, and uses them only to sign upload and download URLs, to read the size of files when they are sent, and to delete the objects it wrote.
Change log
| Date | Change |
|---|---|
| 2026-10-28 | Added Zoho Corporation B.V. for our email mailboxes. Listed Apple (APNs) and Google (Firebase Cloud Messaging), which have delivered push notifications since push launched but were missing from this list. Clarified that Lemon Squeezy is not yet live. |
| 2026-10-26 | Moved hosting from Hetzner Online GmbH (Germany) to Oracle Cloud Infrastructure, region eu-frankfurt-1 (Germany). Data stays in Germany. Hetzner no longer runs any part of the service. This change was made without the 30 days’ notice this page promises; we are sorry, and affected customers are being notified directly. |
| 2026-08-19 | List first published. |
How you find out about a change
Before a new subprocessor begins processing customer personal data we give at least 30 days' notice:
- This page is updated, with the addition dated.
- An email goes to the administrative contacts on every affected account.
To be added to the notification list for an address other than your account owner, email [email protected] and we will register it.
Objecting
You may object to a new subprocessor on reasonable data protection grounds within the notice period. We will work with you in good faith on an alternative; if none can be found within a reasonable time, you may terminate the affected part of the Service without penalty and receive a refund of the unused prepaid portion. The full mechanism is in § 5 of the DPA.
What we deliberately do not use
- No advertising or marketing-analytics platform touches customer data.
- No third-party session recording, heat mapping, or error-tracking service receives message content.
- No machine-learning provider receives Customer Content. We do not use it to train models, ours or anyone else's.
- No data broker, enrichment service, or lead-generation tool is in the pipeline at any point.