This is a convenience translation. Only the German version is legally binding.
This list names the service providers we use in providing Macreto. It forms part of our Data Processing Agreement and supplements our Privacy Policy. We inform business customers of changes by e-mail at least four weeks in advance.
Sub-processors (Unterauftragsverarbeiter) for customer content
| Name | Registered office | Purpose | Data categories | Place of processing / legal basis for third country |
|---|---|---|---|---|
| Hetzner Online GmbH | Industriestr. 25, 91710 Gunzenhausen, Germany | Hosting of the app and database, object storage for recordings and results, operation of the self-hosted transcription, web analytics (Umami) and error monitoring (GlitchTip) | All customer content: recordings (image, audio), transcripts, results, account data, technical logs | Germany – no third country |
| Anthropic PBC | San Francisco, California, USA | AI analysis, script creation, texts (title, description, posts), evaluation of image excerpts | Transcripts, project details, texts, individual still images or image excerpts from recordings | USA – EU-US Data Privacy Framework (Art. 45 GDPR) and EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) via Anthropic's Data Processing Addendum; according to Anthropic, API data is not used for model training |
| ElevenLabs | New York, USA / London, United Kingdom | Optional transcription (Scribe) | Audio track of the recordings, transcript created from it | USA – EU-US Data Privacy Framework or EU Standard Contractual Clauses according to ElevenLabs' DPA |
| Zernio Software SL | Carrer Mallorca 2A, 17230 Palamós (Girona), Spain | Scheduling and publishing of posts on connected social media accounts (only if the customer connects accounts) | Access tokens and identifiers of connected accounts, videos, texts and images to be published, schedules, post statistics | Spain (EU) |
| Brevo (Sendinblue GmbH) | Köpenicker Straße 126, 10179 Berlin, Germany | Sending of system e-mails (confirmation, notifications, invoice notices) | E-mail address, name, content of the e-mail, sending and delivery logs (deleted after 30 days) | EU – no third country |
Service providers without transfer of personal data
| Name | Registered office | Purpose | Data transferred | Note |
|---|---|---|---|---|
| Kie AI (operated by NexusAI Services LLC and Innoleap AI LLC) | Colorado, USA | Access to AI models for generating images, sound effects and music (including image models, ElevenLabs sound effects, Suno music) | Exclusively text descriptions (prompts) without personal data; no recordings, no image or audio of the customer | Kie AI forwards prompts to the respective model providers. According to Kie AI, generated files are automatically deleted after 14 days. As no personal data is transferred, Kie AI is not a sub-processor within the meaning of Art. 28 GDPR. |
Other recipients (own responsibility)
The following service providers do not process data as sub-processors for customer content, but within the scope of our own contractual relationship with you:
| Name | Registered office | Purpose | Data categories | Legal basis for third country |
|---|---|---|---|---|
| Stripe Payments Europe, Limited | 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland | Payment processing, subscription management, customer portal, invoices, VAT calculation (Stripe Tax), fraud prevention | Name, address, e-mail, VAT ID, payment data, IP address, transaction data | Ireland (EU); transfer to Stripe, Inc. (USA) on the basis of the EU-US Data Privacy Framework or EU Standard Contractual Clauses |
| Social media platforms (e.g. YouTube/Google, Meta, TikTok, LinkedIn) | Depending on the platform | Publication of your posts if you use auto-posting | Published content, account identifiers | Processing within the scope of your own user relationship with the platform |
Self-operated software
We operate the following tools ourselves on our servers at Hetzner in Germany; no data is transferred to the manufacturers:
- faster-whisper – transcription of recordings,
- Umami – cookieless audience measurement without personal profiles,
- GlitchTip – error monitoring.
Last updated: [STAND fehlt]