Six third parties touch VINCHY data today. Each one is listed here with what it does, which data it sees, where that happens and on what legal basis it may leave the EU. This page is the authoritative list referenced by our data processing agreement (AVV/DPA); when it changes, the date above changes with it.
Order follows the data flow: storage, API, AI, email, SMS, analytics. “Transfer basis” names what allows data to leave the EU where it does; “none required” means it does not leave.
| Provider | Purpose | Data categories | Location | Transfer basis |
|---|---|---|---|---|
| Supabase, Inc. San Francisco, USA · EU hosting | Database and storage (PostgreSQL) for all application records | Audit chain, approvals, agent registry, conversations, account data | Frankfurt am Main, Germany — AWS eu-central-1 | None required (EU hosting); Supabase DPA incl. SCCs for support access |
| Vercel, Inc. San Francisco, USA · EU functions | Hosting: serverless API functions, static pages, TLS | Request data in transit; no records stored | Functions: Frankfurt (fra1). Static pages and TLS: nearest edge | None for processing (fra1); Vercel DPA incl. SCCs for edge and support |
| Mistral AI SAS Paris, France | AI inference: policy screening, assistant, voice (Voxtral STT/TTS), document reading (OCR) | Prompt text, audio clips, document images sent for one request | EU / EFTA data centres via regional endpoint api.eu.mistral.ai (Azure SE/NO, Google Cloud NL/BE, Mistral Compute FR, CoreWeave EEA) | None required; Mistral Data Processing Addendum; Zero Data Retention enabled for our organisation on all five endpoints (confirmed in writing 15 Oct 2026); API data excluded from training |
| Resend, Inc. San Francisco, USA | Transactional email: approval notifications, invitations, confirmation links | Recipient address, subject, email body | Ireland — region eu-west-1 (sending domain vinchy.ai verified there) | Processing in EU; Resend DPA incl. SCCs for US support access |
| Twilio, Inc. San Francisco, USA | SMS reminders — only after the recipient’s double opt-in | Phone number, message text | United States | Standard Contractual Clauses (Twilio DPA); EU-US Data Privacy Framework where certified |
| Google Ireland Ltd. Dublin, Ireland (Google LLC, USA) | Website analytics (GA4) on public marketing pages only, loaded only after cookie consent; the application carries no analytics | Pseudonymous usage data, truncated IP | EU / United States | Consent (Art. 6(1)(a) GDPR); Google Ads Data Processing Terms incl. SCCs / DPF |
Retired: OpenAI (voice preview) — removed 14 October 2026; no VINCHY data has been sent to OpenAI since.
Before a new sub-processor receives any customer data, this page is updated and the date at the top changes. Customers with a signed AVV are notified by email to their account address and may object within 30 days under the AVV. We do not add sub-processors silently.
Our data processing agreement (AVV, Art. 28 GDPR) with this list as its annex, the provider DPAs we rely on, and a dated PDF export of this page. Write to hello@vinchy.ai; the team that runs VINCHY answers, not a call centre.
VINCHY is built and operated by DreamSoft AI Studio, the AI studio of SIGOO GmbH — a German software and design house building systems for companies and public institutions since 2012. SIGOO GmbH is the legal entity and contracting party (see the Legal Notice). Data processing questions go to hello@vinchy.ai.
Because honesty beats a clean-looking list. Supabase, Vercel and Resend process VINCHY data inside the EU, but they are US-headquartered and their staff could in principle access systems for support. We name that and rely on their DPAs with Standard Contractual Clauses for exactly that case.
Only two flows: SMS through Twilio (if you enable SMS reminders) and consent-gated website analytics (GA4). Everything else — records, API processing, AI inference, email delivery — stays in the EU. See Where your data lives for the component map.
No. VINCHY never trains models on customer data. At Mistral AI Zero Data Retention is enabled for our organisation on the EU endpoint (confirmed in writing on 15 October 2026), the training opt-out is set, Labs models are disabled, and pay-as-you-go API data is excluded from training under Mistral's Commercial Terms. No other listed provider receives prompts or documents.
Yes. Request the AVV (Art. 28 GDPR) with this list as Annex 3 at hello@vinchy.ai. The dated version of this page is the binding list.
Request the data processing agreement with this list as its annex. We answer within two working days.
Request the AVV