Legal
Sub-processors
Last updated 3 November 2026. Suhep is provided by Hostao L.L.C. These companies process personal data for Suhep. We give at least 30 days' notice of changes, as set out in the DPA. E-mail dpo@suhep.com to receive change notices.
| Company | What it does for Suhep | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH | Hosting: application (Falkenstein, Germany), database and file storage (Helsinki, Finland), our own AI model service | All service data | EU (Germany, Finland) | EU, no transfer |
| Google (Google Ireland Ltd / Google LLC) | Outgoing e-mail for Suhep notifications (Google Workspace), backup storage (Google Drive), optional Sign in with Google, Gemini as a fallback model for some platform AI answers | E-mail address and content of notifications; backup files; AI prompts with ticket text when the fallback is used | EU / United States | EU-U.S. Data Privacy Framework, SCCs |
| Anthropic PBC | AI answers and ticket triage when you do not bring your own key | Ticket text sent in AI prompts | United States | SCCs |
| Meta Platforms Ireland Ltd | WhatsApp Cloud API and Instagram messaging, only if you connect them | Messages, phone numbers and handles | EU / United States | Meta terms, EU-U.S. Data Privacy Framework, SCCs |
| FunFirst s.r.o. (Emailit) | Inbound e-mail processing for your Suhep forwarding address and delivery events | Inbound e-mail content and addresses | EU (Czech Republic) | EU, no transfer |
| Twilio Inc. | SMS, phone verification and voice where enabled | Phone numbers, message content | United States | EU-U.S. Data Privacy Framework, SCCs |
| Cloudflare, Inc. | Turnstile bot protection on sign-up and public forms | IP address, browser signals | Global network | EU-U.S. Data Privacy Framework, SCCs |
| Razorpay Software Pvt Ltd | Payments for paid plans (card details are entered with Razorpay, not stored by Suhep) | Billing contact, payment details | India | Contract safeguards |
Your own AI key
If you bring your own AI key (OpenAI, Anthropic or Google Gemini), that provider works for you under your own account and terms, not as a Suhep sub-processor.
Website-only tools
These are not used inside the Suhep app. On suhep.com marketing pages they load only after you agree in the COKIQ consent banner: Google Analytics, Google Ads, Meta and Reddit measurement.
More
See the trust overview and the security whitepaper. Hostao L.L.C, 30 N Gould St, Ste 4000, Sheridan, Wyoming 82801, USA.