Sub-processor List
Last updated: 26-Oct-2026
Data Protection at DoLoop
- German company under EU law. DoLoop GmbH is based in Berlin, Germany, and is subject to the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
- Hosted in Germany. Our application servers, database, file storage and cache run in Frankfurt, Germany.
- Contractually bound providers. Every provider that processes personal data on our behalf is bound by a data processing agreement under Article 28 GDPR.
- Safeguarded transfers. Transfers of personal data outside the European Economic Area are safeguarded by the EU Standard Contractual Clauses or the EU–U.S. Data Privacy Framework.
- No model training by AI model providers. The LLM and embedding providers we use do not train models on your data. The independent web research provider’s handling of imported URLs and retrieved pages is governed by its own terms (see Section 3.7).
- Encryption and isolation. Data is encrypted in transit, our database and file storage are encrypted at rest, and access to each account's data is checked on every request against that account's members and their roles.
- Your control. You can download an export of your account data or delete your account at any time in your account settings, and you can exercise your rights under Articles 15 to 21 GDPR.
- Data processing agreement for business customers. For business customers, our Data Processing Agreement under Article 28 GDPR forms part of our Terms and Conditions and applies automatically.
Where Your Data Is Processed
- Stored in the EU. Your account data, documents and generated content are stored in Frankfurt, Germany. Some providers listed below keep temporary copies while they work, for example chat attachments at Anthropic. The content of email we send or receive for you is stored by Resend in the USA.
- Processed in the EU for every account. Document extraction, Office conversion, audio and video transcription, text embeddings, product analytics and monitoring.
- Processed in Europe by default. Background AI work (analysis, document understanding, memories and chat side tasks) runs in Europe, meaning the EU/EEA, the United Kingdom and Switzerland. Such a request fails rather than leaving Europe. This applies to accounts with EU processing switched on, which is the default; account admins can switch an account to global processing in the account settings.
- Processed globally. Chat (Anthropic), dossier generation, image creation and editing, and spreadsheet reading (OpenAI), place questions (Google Maps), web research and URL import (Valyu), and billing (Polar) use providers outside Europe, under the safeguards described in Section 4. Providers' account, billing and usage records may be kept in the USA.
1. Introduction
This document lists the sub-processors (subcontractors) that DoLoop GmbH, Französische Straße 47, 10117 Berlin, Germany ("DoLoop," "we," "us") engages to process personal data and Customer Data on our behalf in connection with the DoLoop Service.
This Sub-processor List is incorporated by reference into our Terms and Conditions, Privacy Policy and Data Processing Agreement.
2. Changes to This List
We may update this Sub-processor List from time to time as we engage new sub-processors or change existing ones. We inform you by email at least fourteen (14) days before a new sub-processor begins processing your personal data. Within that period you may object on reasonable data protection grounds. We will then try in good faith to find a solution; if none is found, you may terminate the affected Subscription with effect from the change, in accordance with Section 5 below.
3. Current Sub-processors
3.1 Infrastructure and Hosting (EU)
| Sub-processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Supabase Pte. Ltd. | Database services (PostgreSQL) | Account data, Service usage data | EU (Frankfurt) |
| Upstash, Inc. | Database services (Redis caching) | Session data, cached queries | EU (Frankfurt) |
| Amazon Web Services EMEA SARL | File storage and backups (S3) | Uploaded documents, backups | EU (Frankfurt) |
| Temporal Technologies, Inc. | Durable workflow orchestration | Workflow state, task data | EU (Frankfurt) |
| Fly.io, Inc. | Application hosting | All Service data in transit | EU (Frankfurt) |
| Vercel, Inc. | Application hosting and edge functions | All Service data in transit | EU (Frankfurt) |
3.2 Communications
| Sub-processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Plus Five Five, Inc. (Resend) | Email delivery; receipt of email sent to a venture's intake address | Email address, name, email content (including shared chat content and files, support requests, notifications); content of received email (message text, attachments, sender and recipient addresses, including third parties' data in forwarded mail) | Sent from the EU; content of sent and received email and logs stored in the USA |
3.3 AI and LLM Services (Global)
| Sub-processor | Purpose | Data Processed | Location |
|---|---|---|---|
| OpenRouter, Inc. | LLM API gateway | Prompts containing user content | Europe (EU/EEA, UK, Switzerland) for accounts with EU processing (the default), except dossier generation and image generation; Global otherwise |
| OpenAI Ireland Ltd | LLM provider; image generation and editing; spreadsheet reading | Prompts containing user content; images submitted for editing; uploaded spreadsheets | Global |
| Anthropic Ireland, Limited | LLM provider, including server-side web search, web fetch, and code execution tools | Prompts containing user content; files attached in chat | Global |
| Google Cloud EMEA Limited | LLM provider; location answers grounded in Google Maps (Gemini API) | Prompts containing user content; location queries | Global |
| MongoDB Limited (Voyage AI models on MongoDB Atlas) | Text-embedding generation for semantic search and retrieval | Excerpts of user content composed for embedding | EU |
Note on AI/LLM Processing:
- We access large language models from OpenAI, Anthropic, and Google directly through their APIs and via OpenRouter, an API gateway
- OpenRouter is configured with prompt/completion logging disabled by default
- OpenRouter EU processing: For accounts with EU processing switched on (the default; account admins can change it in the account settings), requests through OpenRouter are processed only by model providers in Europe (the EU/EEA, the United Kingdom and Switzerland), and a request fails rather than leaving Europe. Two exceptions are processed globally for every account: dossier generation, which uses a fast response tier that is not available in Europe, and image generation or editing when it runs through OpenRouter. OpenRouter keeps account and billing records in the USA
- Under their standard API terms of service, the LLM providers do not use your data to train their models
- Prompts are processed to generate responses and are subject only to limited retention for abuse monitoring and safety purposes (typically 30 days or less, depending on the provider), except as noted below for Anthropic's server-side tools
- Anthropic: Files attached in chat may be stored with Anthropic while the Service needs them and are deleted afterwards. Where AI features use Anthropic's server-side web search, web fetch, or code execution tools, related data may be retained by Anthropic for up to 30 days.
- OpenAI image generation: Image prompts and any images submitted for editing are processed by OpenAI to generate or edit images
- OpenAI spreadsheet reading: Uploaded spreadsheets are sent to OpenAI to be read. They expire after one hour and are deleted once reading completes; OpenAI does not store the conversation (
storedisabled) - Google Maps grounding: Place and location questions are sent to Google's Gemini API with Google Maps grounding to answer them
- MongoDB (embeddings): We use Voyage AI models, provided by MongoDB through MongoDB Atlas, to generate text embeddings — numerical representations of content that power semantic search and retrieval within the Service. Embedding requests are processed within the EU and are not served from other regions. Request data that MongoDB retains for logging is stored within the EU. Data collection for model training is switched off on our account, so inputs are not used to train models
3.4 Document Processing (EU / Global)
| Sub-processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Lunaweb GmbH (CloudConvert) | Office document conversion to PDF | Uploaded documents | EU (Germany) |
| Endless Labs, Inc. (dba Datalab) | Document extraction and processing | Uploaded documents | EU |
| AssemblyAI, Inc. | Audio and video transcription | Uploaded audio and video files | EU |
Note on Document Processing:
- CloudConvert: Office documents (e.g., Word, Excel, PowerPoint) are converted to PDF within the EU (Germany). Files are deleted within 24 hours of conversion. Lunaweb GmbH, which operates CloudConvert, is a German company subject to GDPR.
- Datalab: Uploaded documents are processed within the EU. Documents and extraction results are deleted automatically within one day of processing. Only non-personal metadata (document name, page count) is retained thereafter. Datalab does not use our data to train its models.
- AssemblyAI: Uploaded audio and video files are transcribed to text within the EU. Files are processed and deleted upon completion of transcription. AssemblyAI does not use customer data to train its models.
3.5 Observability and Analytics (EU)
| Sub-processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Dash0 Inc. | Essential operational telemetry and application performance monitoring | Technical data, error logs | EU |
| PostHog, Inc. | Product analytics, session replay, AI usage analytics | Usage data, session recordings, AI prompts and responses | EU (Frankfurt) |
3.6 Payments and Subscriptions (USA)
| Sub-processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Polar Software, Inc. | Subscription and payment management | Payment data, email, name | USA |
Note on Payment Processing:
- Data limited to: name, email address, payment method details, subscription status
3.7 Independent Providers
The following provider receives data from the Service but acts as an independent controller under its own terms, not as our sub-processor.
| Provider | Purpose | Data Received | Location |
|---|---|---|---|
| Valyu.Network LTD | Web research for market and competitive analysis; retrieving URLs submitted for document import | Research queries generated from venture context; research briefings written by users; submitted URLs and the retrieved page content | United Kingdom, European Union, United States |
Note on Web Research:
- Valyu: Automatic market and competitive research sends queries that DoLoop generates from the venture's market context (such as category, buyers and geography). Research a user requests sends the briefing the user writes, verbatim. When a user imports a web page as a document, Valyu fetches the submitted URL and returns the page as markdown. Uploaded documents and chat history are not sent. Valyu processes query content to return results, improve API performance, secure its systems, prevent abuse, and meet legal or contractual obligations; it does not use it to train models. Query content is typically deleted within 24 to 72 hours. These query-specific retention and no-training statements do not establish Valyu's handling of submitted URLs or retrieved page content; URL imports are governed by Valyu's own terms. Transfers to Valyu in the United Kingdom rely on the EU adequacy decision for the United Kingdom.
4. International Data Transfers
The majority of personal data is processed within the European Union. Every sub-processor is bound by a data processing agreement with us. Transfers of personal data outside the European Economic Area are safeguarded by the EU Standard Contractual Clauses or, where the provider is certified, the EU–U.S. Data Privacy Framework, as set out in our data processing agreement with each provider. A copy of the applicable safeguards is available on request at info@doloop.cc. The location of each sub-processor is shown above.
We select providers who demonstrate commitment to data protection and who implement appropriate technical and organizational measures to protect personal data.
5. Your Rights Regarding Sub-processor Changes
If you object to a new sub-processor and we cannot resolve your objection, you may terminate your Subscription by written notice to us, with effect from the change.
Upon such termination:
- Your Subscription will end effective immediately or at a date you specify within the notice period
- We will provide a pro-rata refund of any prepaid fees for the unused portion of your Subscription term
- You may request an export of your data prior to termination
To exercise this right, contact us at info@doloop.cc.
6. Contact
If you have questions about this Sub-processor List or our data processing practices, please contact us:
DoLoop GmbH
Französische Straße 47
10117 Berlin
Germany
Represented by the managing directors: Olaf Lenzmann, Oliver Eckart
Commercial register: Amtsgericht Charlottenburg, HRB 291197 B
Email: info@doloop.cc
This Sub-processor List is effective as of 26-Oct-2026.
Received-email lifecycle (Resend)
Resend stores incoming messages even if a webhook is unavailable or no webhook is configured (provider inbound documentation). Its published GDPR retention policy, checked on 2026-10-23, states that email and log data is retained for 30 days on Free, Pro and Scale plans; Enterprise retention is contract-specific. Remaining customer data is deleted within 90 days after account termination. These are provider policy periods, not DoLoop application tunables; the deployed account's contract must be checked before making a more specific commitment.
DoLoop screens received mail before ingestion and keeps only accepted content as documents. Intake does not request immediate deletion of the provider copy. Provider-held received mail follows the applicable provider retention policy; accepted documents and the local retry reply envelope follow account/venture deletion. A deletion request requiring provider intervention is handled through the provider's support/privacy process; no automated per-message provider cleanup is promised.