Sign in Create account

Subprocessor List

Last updated: October 14, 2026

GDPR Art. 28 transparency: this list identifies every external service that processes personal data on behalf of vaicat B.V. for CUEBES. We notify you at least 30 days before any new subprocessor is added or any existing one is replaced.

Key Facts

  • All listed subprocessors are EU-based or covered by appropriate transfer mechanisms (SCCs, adequacy)
  • Each has a signed Data Processing Agreement, except where flagged "DPA pending"
  • Read-only data sources (we fetch from them — no user PII flows out) are listed separately for transparency, but are not GDPR Art. 28 subprocessors
  • 30-day advance notice for changes (subscribe to platform notifications to receive updates)

This list is the public mirror of vaicat B.V.'s internal subprocessor register. It applies to the CUEBES platform and the integrated apps (EUnify, mEUvy, EUorigin, CathAI). For the GDPR rights you can exercise against any subprocessor's processing of your data, see the Privacy Policy.

1. Core Subprocessors

These parties process personal data on vaicat's instructions in the ordinary operation of CUEBES.

1.1 Leaseweb (VPS hosting)

  • Vendor: Leaseweb Netherlands B.V.
  • Service: dedicated / virtual server hosting (compute, database, application)
  • Data: all CUEBES data — accounts, content, code, messages, audit logs
  • Region: Amsterdam, Netherlands (EU)
  • DPA: Leaseweb standard EU DPA

1.2 Amazon Web Services (S3)

  • Vendor: Amazon Web Services EMEA SARL
  • Service: object storage for user-uploaded files, media, and encrypted backups
  • Data: avatars, video uploads, attachments, document uploads, backup archives
  • Region: eu-west-1 (Ireland)
  • DPA: AWS GDPR DPA (auto-applies on AWS terms)

1.3 Apple Push Notification Service (APNs)

  • Vendor: Apple Distribution International Limited
  • Service: mobile push-notification routing for iOS apps (mEUvy, EUorigin, EUnify, CathAI)
  • Data: device push tokens; notification payloads en route to user devices
  • Region: Apple's globally distributed APNs infrastructure
  • DPA: Apple Developer Program Agreement covers data-processor terms

1.4 Apple (Sign In with Apple)

  • Vendor: Apple Distribution International Limited
  • Service: OAuth identity provider for the Sign-In-with-Apple flow
  • Data: email address (real or relay) and name (if user permits) during the auth handshake
  • Region: Apple's globally distributed auth infrastructure
  • DPA: Apple Developer Program Agreement

1.5 OVH (transactional email + cuebes.eu mailboxes)

  • Vendor: OVH SAS
  • Service: outbound SMTP relay for every transactional and GDPR-rights email sent by CUEBES, plus inbound mailbox hosting for @cuebes.eu addresses
  • Data: sender + recipient + subject + body of all CUEBES outbound mail (signup verification, password reset, GDPR request acknowledgements, breach notifications, subprocessor-change notices); inbound replies to noreply@cuebes.eu
  • Region: France (OVH headquartered in Roubaix; EU)
  • DPA: OVHcloud Data Processing Addendum (auto-applies on OVHcloud account terms)

1.6 Google Workspace (vaicat.com mailboxes)

  • Vendor: Google Ireland Limited
  • Service: inbound mailbox hosting only — for the legal/regulatory addresses we publish (privacy@, legal@, security@, abuse@, support@, billing@, etc. on vaicat.com)
  • Data: inbound emails received at vaicat.com — i.e. user replies to legal/privacy contacts, GDPR-rights requests, complaints, security disclosures
  • Region: Google Ireland Limited (EU); global delivery
  • DPA: Google Workspace Data Processing Amendment
  • Note: CUEBES does not send mail through Google — outbound goes through OVH (§1.5). Google only receives mail addressed to our published vaicat.com contacts.

2. Conditional Subprocessors

These services receive personal data only when a user opts into a specific feature.

2.1 Google (YouTube Data API)

  • Vendor: Google Ireland Limited
  • Service: YouTube Data API + OAuth, used by users who connect a YouTube channel to a CUEBES Cube for the Wave / Cube YouTube-sync feature
  • Data: OAuth access tokens (scope: youtube.readonly, 30-day TTL), channel metadata, per-channel sync metrics
  • Region: EU + global (Google's standard infrastructure)
  • DPA: Google Cloud Data Processing Addendum
  • Trigger: only invoked when a user explicitly authorises a YouTube connection

2.2 Federated networks (Mastodon, Bluesky)

  • Vendors: Mastodon instances (mastodon.social, mastodon.world, fosstodon.org), Bluesky AT Protocol
  • Service: public-content fetching for the auto-syndication feature in institution and topic cubes
  • Data: we fetch public posts and profile metadata; no user PII flows out. Listed here for transparency, not as a GDPR Art. 28 subprocessor.
  • Region: federated / globally distributed

3. Read-Only Data Sources (Not Subprocessors)

CUEBES queries the following public or regulated APIs server-side. No personal data flows to them. They are listed for transparency only.

  • OpenStreetMap and CARTO — map tiles are requested through fixed, server-side CUEBES templates. Visitors connect only to CUEBES, so the tile providers do not receive their IP address, cookies, referrer, or browser user-agent. An uncached request still sends the requested tile coordinates from the CUEBES server. Tiles are cached on CUEBES according to the provider's cache lifetime (capped at 30 days); stale cache files are pruned after 60 days.
  • Podcast Index (podcastindex.org) — podcast metadata fetched server-side for Cath and other app integrations
  • Curated podcast publishers and their media/CDN hosts — CUEBES fetches RSS metadata and mirrors cover artwork for the selected catalogue. Playback is streamed through a signed CUEBES URL without forwarding the visitor's IP address, cookies, referrer, or browser user-agent; the upstream receives only a CUEBES server request plus any required byte-range or cache-validator headers. Audio is not stored by CUEBES.
  • German Bundestag API (bundestag.de) — German political data for the Politics module
  • NASA FIRMS — fire-information map layer
  • AISStream — vessel positions on the INFINITE map
  • OpenSky Network — flight-tracking data on the INFINITE map
  • ACLED — armed-conflict event data
  • Finnhub — European-market financial data for Breaking News
  • Wikidata / Wikipedia — institution and EUorigin data enrichment (with polite User-Agent per WMF guidelines)
  • Crossref — academic-citation lookups for the EUnify Papers provider

4. Not a Subprocessor

These are sometimes mistaken for subprocessors. They are not.

  • Apple Foundation Models (CathAI on-device): the model runs entirely on the user's device. No data is sent to Apple for model inference itself.
  • FAISS sidecar (localhost:5930): runs on the same VPS as Laravel — not an external party.
  • Laravel Reverb (WebSockets): self-hosted on the VPS.
  • Redis, MySQL: self-hosted on the VPS.

5. Changes & Notification

When we add a new subprocessor or replace an existing one, we notify all account holders in the platform and by email at least 30 days before the change takes effect. The notification includes the new subprocessor's identity, the data they will process, the legal basis, and the planned effective date.

We commit to this advance-notice mechanism even where law does not strictly require it, because changing who can see your data should never be a surprise.

If you object to a planned change, you can close your account before the effective date and we will assist with data export or deletion under the Privacy Policy.

6. Contact

Questions about a specific subprocessor, our DPAs, or international transfers? Email privacy@vaicat.com.

Operator

  • vaicat B.V.
  • Noordeinde 99B, 2514 GD The Hague, Netherlands
  • KvK (Dutch Trade Register): 89360672
  • Email: privacy@vaicat.com

We use essential cookies for sign-in and security. Optional preferences and media embeds are your choice. Analytics is off platform-wide. Learn more