Sub-processors

This list is part of the Data Processing Agreement. It names the third parties that process the personal data of your apps' users on Exostack's behalf, and explains the role of delivery and payment providers. Website advertising measurement providers are listed separately and do not process Device Data.

Sub-processors for Device Data

Sub-processor	Service	Data	Location
Scaleway SAS, 8 rue de la Ville-l'Évêque, 75008 Paris, France	Serverless containers and instances running the API, dashboard and worker; managed PostgreSQL database and its backups; Key Manager and Secret Manager; Cockpit logs, traces and metrics	All Device Data stored by the service, encrypted provider credentials, technical logs	European Union

Scaleway Transactional Email, hosted in the European Union, sends Exostack's emails to the people who use the dashboard. Those emails carry account information, not Device Data.

Delivery providers you designate

Notifications are delivered by the push services of the mobile platforms:

Provider	Operated by	What it receives
Apple Push Notification service (APNs)	Apple	The device token and the notification payload of each iOS delivery, authenticated with the APNs key you upload
Firebase Cloud Messaging (FCM)	Google	The device token and the notification payload of each Android delivery, authenticated with the Firebase service account you upload

These providers are not engaged by Exostack. You hold the Apple Developer account and the Firebase project; you upload their credentials; Carillon transmits each notification to them on your instruction, and the processing they perform is governed by your own agreements with Apple and Google. They are not bound by Carillon's European hosting, and may process tokens and payloads outside the European Union. To reduce what they receive, send an identifier in the payload and let your app fetch the content after opening. Test keys send nothing to either provider.

Payments

Stripe processes billing for organizations that activate a paid plan, as merchant of record through Link. It receives the Carillon organization identifier and the organization's usage totals, and collects the payer's details directly. It receives no Device Data, app names or notification content, and is therefore not a sub-processor for Device Data. See the Privacy Policy.

Website campaign measurement

This processing concerns website visitors only and is outside the scope of product and Device Data processing under the DPA. Exostack acts as controller for this measurement.

Processor	Purpose	Data	Location	Legal basis
Vibe Media Inc.	Connected-TV campaign attribution	IP addresses of US visitors to carillon.dev/tv, timestamps and random event identifiers	United States	Legitimate interest

Events are sent server-to-server only for visitors located in the United States. No advertising script or cookie is placed in the browser. No event is sent for visitors in the European Union, the United Kingdom, Switzerland or any other country. Vibe receives no account data, Device Data or notification content through this measurement. See the Privacy Policy.

ChatGPT campaign measurement

Processor	Purpose	Data	Location	Legal basis
OpenAI	ChatGPT campaign attribution	ChatGPT click reference, event type, timestamp and organization-based event identifier for accounts arriving from a ChatGPT advertisement	United States	Legitimate interest

Registration and first successful live push events are sent server-to-server. No email, IP address, browser user agent, Device Data or notification content is transmitted. This integration places no advertising script, pixel or cookie in the browser. See the Privacy Policy.

European hosting

Every sub-processor of Device Data is established and hosts that data in the European Union. The only transfers of Device Data outside the Union are the deliveries to APNs and FCM described above, made on your instruction.

Changes to this list

Exostack will notify the owners of each organization by email of planned additions or replacements of sub-processors of Device Data, and will update this page. You have an opportunity to object on reasonable data protection grounds before the new sub-processor processes Device Data. If the objection cannot be resolved, you may terminate the affected service before the change takes effect.