Skip to content
domainspacesi

Sub-processors

Last updated:

Providers

Studio 404 d.o.o., registered seat: Gradišče 15C, 1360 Vrhnika, Slovenia, company no.: 6835228000, VAT ID: SI42531357 (office: Slovenska cesta 55, 1000 Ljubljana, Slovenia) operates the service. The providers below process personal data on our behalf. Each is bound by a data processing agreement with obligations no less protective than our own. We update this page before we add or replace a provider; customers who have a data processing agreement with us are also told by email (see the data processing agreement).

  • Railway (Railway Corporation, San Francisco, USA). Purpose: Hosting of our application and its database. Data: Everything our application stores: account, registrant, order and invoice data, website content, messages that pass through it. Location: USA (US West region). Transfer basis: EU standard contractual clauses (Commission Decision (EU) 2021/914).
  • Amazon Web Services (Amazon SES) (Amazon Web Services EMEA SARL, Luxembourg). Purpose: Sending our emails (account and order emails, forwarded contact-form messages, emails sent by Hal). Data: Recipient address and the content of the email. Location: Germany (Frankfurt). Transfer basis: None needed (EEA).
  • Hetzner (Hetzner Online GmbH, Gunzenhausen, Germany). Purpose: Our mail server (mailboxes, email forwarding, webmail) and the placeholder page on parked domains. Data: Email content, addresses and delivery logs; IP addresses of visitors to parked domains. Location: Germany. Transfer basis: None needed (EEA).
  • Cloudflare (Cloudflare, Inc., San Francisco, USA). Purpose: Hosting of website-package sites and their DNS, spam protection of contact forms (Turnstile), storage of encrypted mail-server backups. Data: Website content, DNS records, IP addresses of site visitors, encrypted backups. Location: Global network; backups stored in the EU. Transfer basis: EU-U.S. Data Privacy Framework and EU standard contractual clauses.
  • Openprovider (Hosting Concepts B.V., Netherlands). Purpose: Registrar platform: registering and renewing domains, DNS for domains registered with us. Data: Registrant data, domain names, DNS records. Location: Netherlands. Transfer basis: None needed (EEA).
  • Stripe (Stripe Payments Europe, Limited, Ireland). Purpose: Card payments, refunds and saved cards for automatic renewal. Data: Email address, order amounts and references; card data is entered at Stripe and never reaches us. Location: EU, with Stripe, Inc. in the USA. Transfer basis: EU-U.S. Data Privacy Framework and EU standard contractual clauses.
  • Space Invoices (Space Invoices d.o.o., Slovenia). Purpose: Issuing invoices and credit notes. Data: Name or company name, address, VAT number, email address, invoice lines. Location: EU. Transfer basis: None needed (EEA).
  • PostHog (PostHog Inc., San Francisco, USA). Purpose: Product analytics (how the site is used). Data: Page views and actions on the site; with your consent also a random identifier and your account. Location: EU cloud (Germany). Transfer basis: EU standard contractual clauses (Commission Decision (EU) 2021/914).
  • Mistral AI (Mistral AI SAS, France). Purpose: Risk check of new registrations (brand abuse, phishing) and the weekly domain ideas email. Data: Domain names, registrant type, company name and country; never a person's name, email, phone or address. Location: EU. Transfer basis: None needed (EEA).

Our own systems

Hal and Damper are products of the same company (Studio 404 d.o.o.). Where your data passes through them, the providers they use are listed here.

  • Hal (chatwithhal.com), our own system for the support chat, the customer record, account and order emails and online booking. It runs on Railway in the EU (Netherlands), sends email through Amazon SES (Frankfurt) and may use Anthropic, PBC (USA; EU standard contractual clauses) to suggest replies to support messages.
  • Damper (usedamper.com), our own system for feature suggestions, the roadmap and the status page. It runs on Railway in the EU (Netherlands) and only receives what you send through the suggestion form.

Not sub-processors

  • Domain registries (for .si Register.si, operated by ARNES; for other endings their own registry) receive registrant data as independent controllers under their own rules.
  • Google receives advertising measurement data as an independent controller, as described in the privacy and cookie policies.
  • If you connect your own Google Calendar for online booking, Google acts under your own agreement with Google.

Suggest a feature

Your email, so we can reply and tell you when it ships.