Last updated: 2 November 2026
Subprocessors
YOWO7 uses selected processors and auxiliary services to operate the platform. The list below constitutes the approved subprocessors under our Data Processing Agreement (https://www.yowo7.com/en/dpa). We notify workspace owners by email of any intended addition or replacement of a subprocessor at least 14 days before it takes effect and update this list (§ 7 DPA). The customer may object in text form within that period on important data-protection grounds. If no reasonable remedy is possible, either party may terminate the contract with respect to the affected service or in its entirety; fees paid in advance are refunded pro rata. Where a change is urgently required for security or availability reasons, we notify without undue delay afterwards; the right to object remains unaffected.
Two layers: core systems and auxiliary services
Storage and the backend of YOWO7 (application, database, files, platform email, AI) run in the European Union on Amazon Web Services in Frankfurt (eu-central-1). That is where workspace content is stored. Server functions of the web frontends (website, app interface, forms, widget, booking pages, blog, help center) run at Vercel in the Frankfurt region (fra1). Static content is delivered via Vercel’s global CDN from the nearest edge location, so requests can be processed at locations outside the EU. Form submissions are forwarded through it.
In addition we use auxiliary services for payments, captcha, optional calendar connections, video calls, and mobile push. Those providers may also process data in the United States or transfer it there. Workspace content is stored in data centers in Frankfurt, Germany.
How third-country transfers are safeguarded
Where auxiliary services transfer data to the United States, we rely on EU-recognised safeguards: the EU-US Data Privacy Framework (adequacy decision for certified US companies) and/or the EU Standard Contractual Clauses (standard contracts issued by the European Commission with the recipient in the third country). Which mechanism applies depends on the provider and contract.
For Vercel Inc. (USA), the EU-US Data Privacy Framework and Standard Contractual Clauses (SCC) apply. Server functions run in the Frankfurt region (fra1).
Current subprocessors
| Provider | Purpose | Where is data processed? |
|---|---|---|
| Amazon Web Services, Inc. / AWS EMEA | Cloud hosting and infrastructure (application, database, storage, email sending, AI, security) | Data centers in Frankfurt, Germany |
| Vercel Inc. (USA) | Hosting and delivery of the web frontends (website, app interface, forms, widget, booking pages, blog, help center), CDN/edge, forwarding of form submissions | Server functions in the Frankfurt region (fra1); static content via the global CDN from the nearest edge location, including outside the EU; EU-US Data Privacy Framework and Standard Contractual Clauses (SCC) |
| Stripe Payments Europe / Stripe, Inc. | Payments, subscriptions, invoices | EU and possibly USA (Data Privacy Framework and/or EU Standard Contractual Clauses) |
| Google Ireland Limited / Google LLC | Google Analytics 4 (on yowo7.com, docs.yowo7.com and blog.yowo7.com, in each case only after consent); reCAPTCHA (forms); Google Calendar OAuth | EU and possibly USA (Data Privacy Framework and/or EU Standard Contractual Clauses) |
| Cloudflare, Inc. | Turnstile (captcha), RealtimeKit (video calls) | EU/global and possibly USA (Data Privacy Framework and/or EU Standard Contractual Clauses) |
| Microsoft Ireland / Microsoft Corporation | Outlook Calendar OAuth | EU and possibly USA (Data Privacy Framework and/or EU Standard Contractual Clauses) |
| Apple Inc. | APNs (iOS push notifications) | USA (Data Privacy Framework and/or EU Standard Contractual Clauses) |
| Google LLC (Firebase Cloud Messaging) | FCM (Android push notifications) | USA (Data Privacy Framework and/or EU Standard Contractual Clauses) |
Notes
- AWS is the hosting partner for storage and the backend of the platform. Workspace content and AI run there in the EU.
- Vercel Inc. delivers the web frontends (website, app interface, forms, widget, booking pages, blog, help center), including CDN/edge and forwarding of form submissions. As a US company, the EU-US Data Privacy Framework and Standard Contractual Clauses (SCC) apply.
- Stripe processes billing data as a payment provider; it remains part of the infrastructure used under the customer contract.
- Google Analytics and our first-party website tracking (pseudonymous visitor identifier in the yowo7_vid cookie) load on yowo7.com, docs.yowo7.com (help center) and blog.yowo7.com, in each case only after consent — not in the app.
- Calendar connections (Google/Microsoft) store OAuth tokens and synced events only when the customer enables the integration.
- Push services (Apple/Google) are required to deliver mobile notifications.
- There are no product-analytics services such as PostHog, Sentry, or Plausible in the platform.
This page is available in German and English. In case of discrepancies, the German version prevails.