Legal
Subprocessors
Last updated 2026-08-16
The list is short: age checks carry no identity data, so very little personal data exists to hand to anyone. These are the external services that process personal data on our behalf:
| Provider | Location | What it processes |
|---|---|---|
| Hetzner Online GmbH | Germany (servers in Helsinki, Finland) | Hosting of the entire service, including databases and backups. All customer and account data lives here, inside the EU. Our DPA with Hetzner is concluded (2026-08-13); the executed copy and the TÜV Rheinland audit report of their data centres are confidential and available on request. Their DPA template (PDF) · Their security measures (PDF) |
| Resend, Inc. | EU (Ireland region); provider incorporated in the United States | Transactional email (signup verification, password resets, invitations and a welcome email), sent only when email sending is enabled. Processes recipient email addresses in Resend's EU region. The provider is a US company, so their EU-US Data Privacy Framework certification and the EU standard contractual clauses in their DPA remain in place to cover any residual access from the parent. Their DPA · Their subprocessors |
Run by us, not subprocessors
Website analytics (Umami) and error monitoring run on our own infrastructure in the EU. They involve no third party.
Changes
Before adding or replacing a subprocessor we update this page and email customers at least 14 days in advance, so there is time to object. Questions to hello@tessio.eu.