Sub-processors
Version 1.0 · effective 25 October 2026
This page lists the third parties that process personal data for Margin Flow. It is Annex 3 of our Data Processing Agreement.
- Part A lists sub-processors of Customer Data. For that data we are a processor (see the Privacy Policy).
- Part B lists providers we use for data we hold as controller.
We do not pass Customer Data to any other third party. We announce changes to Part A at least 30 days in advance, and Customers may object, as described in section 6 of the DPA.
A. Sub-processors of Customer Data
| Sub-processor | Purpose | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH, Germany | Hosting of the application, the database, uploaded documents and local backups | All data in the Service | Hetzner Online GmbH servers in the EU (Germany — Falkenstein, and Finland — Helsinki) | None needed (EU). Hetzner data processing agreement |
| OpenAI (OpenAI Ireland Ltd / OpenAI, L.L.C.) | Recognition of invoices. Invoice images, PDF files and the text extracted from them are sent to the OpenAI API to extract fields such as supplier, items, quantities and prices. Under OpenAI's API terms, API data is not used to train models by default and may be retained for up to 30 days for abuse monitoring | Invoice images, PDF files and extracted text. These may include names, signatures and phone numbers that appear on the invoice | USA | Standard Contractual Clauses (OpenAI Data Processing Addendum) and the EU–US Data Privacy Framework |
| Telegram (Telegram FZ-LLC / Telegram Messenger Inc.) — only for Users who link the invoice bot | Running the invoice intake bot @Invoiceinput_bot: receiving invoice photos and files, sending replies | Telegram user ID, Telegram name, messages, invoice photos and files sent to the bot | Telegram's data centres, including outside the EEA | Telegram does not offer data processing terms to bot operators, and there is no DPA with Telegram. Linking the bot is optional for every User. Invoices can be uploaded through the web account instead, and then nothing passes through Telegram |
| Namecheap, Inc. (Private Email) | Sending service emails, such as password resets and email confirmations | Email address, name, email content | USA | Standard Contractual Clauses |
| Google (Google Ireland Limited / Google LLC) | Storage of encrypted off-site backup copies. Backups are encrypted on our side before upload, the key is held only by us, and Google cannot read their content | Encrypted backup files | EU and USA | Google's Standard Contractual Clauses and the EU–US Data Privacy Framework (Google LLC is certified) |
What appears on invoices. A photo or scan of an invoice may show names, signatures or phone numbers of supplier staff, and this content is sent to OpenAI for recognition. Please photograph only the invoice itself, and nothing else.
Not our sub-processors
- The Customer's POS or back-office (for example Syrve or Tillo). At the Customer's request, Margin Flow loads data from the Customer's own POS or back-office account, using access keys the Customer provides. The POS provider works under its own contract with the Customer and is the Customer's provider, not ours. Access is read-only. Margin Flow writes to the POS or back-office only when a User explicitly sends a document to it.
- The Customer's suppliers. Suppliers are the Customer's business partners. We do not send them data.
- IzyShift. If the Customer connects IzyShift, Margin Flow receives aggregated labour cost only, without personal details of staff.
B. Providers for data we hold as controller
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting of the Service, including user accounts, login and acceptance records | EU (Germany and Finland) |
| Namecheap, Inc. (Private Email) | Our email, including enquiries from the marginflow.biz form and support correspondence | USA |
| Telegram | Delivery of enquiries from the marginflow.biz form to our team | Telegram's data centres, including outside the EEA |
| Encrypted backups, as in Part A | EU and USA |
Last updated: 25 October 2026.