Last updated
These are the companies that process customer data on AnyReplay’s behalf. Each is under a written contract that imposes data-protection obligations no weaker than those in our data processing agreement, and each receives only what its job needs.
| Name | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH | Hosting: the servers that run AnyReplay, its PostgreSQL database and, until they move to object storage, the recordings. | All customer data: recordings and their metadata, account and organisation data, audit logs. | Germany | None needed — processed inside the EEA |
| Cloudflare, Inc. | DNS, TLS termination, caching and attack protection in front of every AnyReplay hostname, including the recording endpoint. | All data in transit to and from AnyReplay, including visitors’ and team members’ IP addresses. | Global network; company based in the United States | EU Standard Contractual Clauses (2021/914) |
| Backblaze, Inc. | Object storage: recordings, and the nightly off-site backups of the database — and, while recordings are still kept on our own server, of those too (encrypted on our server before upload). | Recordings (masked page structure, interaction events, page addresses); encrypted backup archives it cannot read. | EU data region; company based in the United States | EU Standard Contractual Clauses (2021/914) |
| Sendinblue SAS | Transactional email: verification links, sign-in codes, invitations, usage and legal notices. | Team members’ names and email addresses, and the content of those messages. | France | None needed — processed inside the EEA |
| OpenAI Ireland Ltd (EEA and UK customers); OpenAI, L.L.C. elsewhere | Translation and Argus: the language model that translates recorded page text when a reviewer asks for it, and that writes Argus’s session summaries, project analyses and fix checks on paid plans. An organisation can turn both off in its settings. | For translation, the visible text of recorded pages, string by string. For Argus, a written timeline of a session: pages by path and title, controls by the words on them, form fields by their label, the customer’s own tagged events, errors and the moments flagged as problems. Typed values are never sent: masked values are never recorded, and Argus never reads a field’s value and removes email addresses, long digit runs and anything seen typed from the text it sends. | United States, with EU data residency available | EU Standard Contractual Clauses (2021/914) |
| RevenueCat, Inc. | Subscriptions bought in the mobile app: it checks the App Store or Google Play receipt, tells us which plan an organisation is on, and keeps that current as the subscription renews, lapses or is refunded. | The organisation’s identifier — what a subscription is attached to, never the person who pressed Buy — the store receipt and the state of the subscription, and the platform and app version it was bought on. No name or email address is sent, and the payment itself is taken by Apple or Google, who never pass us the card. | United States | EU Standard Contractual Clauses (2021/914) |
| Functional Software, Inc. | Error monitoring for the API, the recording endpoint and the dashboard. | Error reports with request bodies, cookies, IP addresses and user details removed before sending; page addresses have their query strings redacted. | United States | EU Standard Contractual Clauses (2021/914) |
Some providers touch AnyReplay without processing our customers’ data on their behalf, so they are not sub-processors:
We publish a new sub-processor here at least 30 days before it starts processing customer data, and email the owners of every organisation at the same time. You can also follow the RSS feed of changes.
If you object to a change on reasonable data-protection grounds, write to [email protected] within that period. We will discuss it with you in good faith; if we cannot resolve it, you may end the affected service as the DPA describes.
Argus, the AI that summarises sessions and analyses projects on paid plans, has used OpenAI since it launched on 26 September 2026. This list named OpenAI for translation only; it should have named Argus too, and that omission is corrected here. Argus sends OpenAI a written timeline of a session — pages, the words on the controls people used, field labels, errors — never what anyone typed. If you do not want session content to reach OpenAI for this purpose, an owner or admin can turn translation and Argus off under Settings, and nothing more is sent from that moment.
· effective
Paid plans are sold through the App Store and Google Play, and RevenueCat is what checks those receipts and tells us which plan an organisation is on. It should have been on this list when the provider was switched on; it was not, and that omission is corrected here. Nobody’s data has reached it yet — the mobile app is not on the stores, so no subscription has been bought through it — so the thirty days run from today and end before the first purchase can happen.
Session text is translated by OpenAI instead of through fal.ai’s gateway. The same text is processed for the same purpose, by one provider directly rather than two in a chain. Effective immediately, and with no notice period: the change was made before this service had a single customer, so neither provider had ever processed anyone’s data and there was nobody the notice protects. Every later change gets the thirty days the DPA promises.
First published list of sub-processors: Hetzner, Cloudflare, Backblaze, Brevo, fal and Sentry.