Sub-processors
Last updated: March 2026
HoldSpace uses the following third-party service providers ("sub-processors") to deliver and operate the Service. Each provider processes data only as necessary for its stated purpose.
We will notify registered users by email at least 14 days before adding a new sub-processor or making material changes to this list.
Infrastructure & Hosting
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Hetzner Online GmbH | Server hosting, data storage | All Service data (accounts, client records, notes, files, AI-generated content) | Finland (Helsinki) |
| MinIO (self-hosted) | Object storage for uploaded files | Client photos, uploaded documents | Same server (Finland) |
AI Processing
| Provider | Purpose | Data sent | Retains data? |
|---|---|---|---|
| Deepgram (Nova-3) | Voice transcription | Audio stream from voice dictation | No — audio processed in real-time, never stored |
| Google (Gemini 2.0 Flash) | Note structuring, session status summaries, deep analysis | Text of session notes | No — contractually prohibited from using data for model training |
AI Processing Details
When a practitioner uses AI-powered features, data is sent to our AI providers as follows:
| Feature | Data sent | Data returned | Provider |
|---|---|---|---|
| Voice transcription | Audio stream | Text transcription | Deepgram |
| Note structuring | Text of one note | Structured text version | Google Gemini |
| Session status summary | Text of previous session notes | Brief status summary | Google Gemini |
| Deep analysis | Text of all session notes for a client | Analytical summary | Google Gemini |
All transmissions use encrypted connections (TLS 1.2+). Audio is never stored on our servers after transcription. AI providers are contractually prohibited from using your data for model training.
Payments
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Polar | Payment processing, invoicing, tax compliance (Merchant of Record) | Email address, subscription selection, billing details (we never see full card numbers) | EU / US |
Communications
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Resend | Transactional emails (verification, password reset, session reminders) | Email address, message content | US |
What We Do Not Use
- No third-party analytics services (we use self-hosted Umami — see "Self-hosted Components" below)
- No advertising or tracking services
- No third-party cookies beyond essential session cookies
Self-hosted Components (Not Sub-processors)
The following run on our own infrastructure under our sole control. They are internal processing activities under GDPR Art. 30, not sub-processor relationships under Art. 28 — no third party processes data on our behalf.
| Component | Purpose | Data processed | Location |
|---|---|---|---|
| Umami Analytics | Aggregate usage analytics (page views, navigation, funnel measurement) | Pseudonymous event data: URL path (template-normalized — no IDs or queries), referrer, browser/OS, device type, country (derived from IP before hashing), visitor hash (monthly-rotating salt — Umami default). NOT stored: raw IP, user ID, email, name, cookies | Hetzner (Helsinki, Finland), same infrastructure as the main Service |
| OpenTelemetry → PostgreSQL | Application performance monitoring, error diagnostics | Trace ID, HTTP method, path, status code, duration, error stack traces, optional user ID | Hetzner (Helsinki, Finland) |
| MinIO | Object storage for client photos and feedback screenshots | Uploaded files (5 MB limit, validated file types) | Hetzner (Helsinki, Finland) |
International Transfers
Deepgram audio processing uses EU-based servers. Where data is transferred outside the EEA (Google, Polar, Resend), we rely on the providers' compliance mechanisms including Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework.
Change Log
| Date | Change |
|---|---|
| March 2026 | Initial publication |