Subprocessors
A subprocessor is a company that handles personal data on our behalf. GDPR requires us to know who they are and to tell you; this page is that list, and it is short on purpose. Avahit runs on its own server rather than on a stack of third-party services, which means fewer companies see anything at all.
| Company | What it does for us | What it can see | Where |
|---|---|---|---|
| Contabo GmbH | Physical server hosting. The database, uploaded media and application logs live on a machine we rent from them. | Everything stored, in principle — as with any hosting provider. Data at rest is on their disks. | Germany (company), France (data centre) — EU/EEA |
| Cloudflare, Inc. | DNS, TLS termination and the reverse proxy in front of the site. Also filters malicious traffic. | IP addresses, request headers and URLs of every visit, as traffic passes through. No account data is stored there by us. | United States, with EU edge locations. Data Privacy Framework participant. |
| Browser push services | Delivering price-drop notifications you have subscribed to. Your browser chooses the service: Google (Chrome), Mozilla (Firefox), Apple (Safari). | An anonymous push endpoint your browser generated, plus the encrypted payload. They cannot read the message contents. | United States / global |
| Email delivery provider | Sending sign-up confirmations, password resets and the price-drop digest. | Your email address and the contents of the message. | To be named here before launch. Transactional mail is not sent until a provider is configured. |
| Anthropic PBC | Optional writing assistance when a creator asks for a suggested caption for their own post. | The product title and image URL sent with that one request. Not enabled on production today, and never triggered by visitors. | United States |
Not subprocessors, but worth naming
- Merchant stores. When you tap a product you leave Avahit and the store takes over, with its own cookies and its own policy. We do not send them your data; you simply arrive.
- Affiliate networks.They attribute a sale to the creator using the cookie the store sets. They are the creator’s partners, not ours, and they receive nothing from us.
- Meta and Google, on creator storefronts. A creator can connect their own pixel to their own pages. Those companies are then independent controllers of what they collect, and the scripts load only after you accept the cookie banner. See Cookie Policy.
What runs on our own machine instead of somebody else’s
Deliberately in-house, because each of these would otherwise mean another company reading your data: the database, image and video processing, search indexing, the visual-similarity model behind “shop similar”, click tracking, price checks, and the fonts on this page.
Changes
We update this page when a subprocessor is added or removed. If you would like to be told in advance, write to [email protected] and we will notify you before the change takes effect. Objections to a new subprocessor are handled as described in the Privacy Policy.
Last updated 2026-08-05.