Subprocessors and service providers
Version 1.0 Effective 7 October 2026
Deploy is a product of Vimonto. These documents are an agreement between you and Vimonto.
Our legal documents are available in English only. The English text is the one that applies.
This register explains providers used for Deploy by Vimonto and distinguishes processing on a customer’s behalf from independent purchase, identity and business services. Vimonto is Luuk Dahlmans trading as Vimonto, Echterstraat 85, 6051 EZ Maasbracht, the Netherlands, Chamber of Commerce number 74936719. Contact info@vimonto.nl.
1 Providers acting on our instructions
The following providers are used within the purposes described below. A provider falls within the customer DPA only to the extent it actually processes Customer Personal Data on our behalf. Development using Vimonto’s own code alone is not processing customer project data.
| Provider | Purpose and data potentially involved | Location information |
|---|---|---|
| Hetzner | Hosting Deploy’s application, management database and platform backups, including stored credentials, configuration and logs | Vimonto selects EU datacentres for these systems |
| Amazon Web Services — Amazon SES | Transactional emails; recipient address, necessary message content and delivery records | The SES service region and authorised AWS support/processing locations; no blanket EU-only processing promise is made for email |
| Google — Google Workspace | Business communications and support; relevant contact details and message content | Google’s applicable service and authorised processing locations, including international processing where relevant |
| OpenRouter, Inc. | Integrated AI routing; submitted prompts, authorised task context, responses and request metadata | United States and the locations of the approved model provider serving the request |
| OpenAI — ChatGPT | Assistance with ticket resolution and development; necessary support and diagnostic extracts where customer data is involved | Relevant OpenAI service locations, which may include the United States; no EU-only inference claim |
| Anthropic — Claude | Assistance with ticket resolution and development; necessary support and diagnostic extracts where customer data is involved | Relevant Anthropic service locations, which may include the United States; no EU-only inference claim |
| Google — Gemini | AI-assisted development, support or an approved AI route; relevant prompts and necessary context | Relevant Google service locations; no EU-only inference claim |
These brand and service names identify the actual supplier groups, not a representation that all services within a group use the same contracting entity. The relevant legal entities, contact details and service-specific affiliate/subprocessor information are identified in the provider documents linked below and in the applicable service agreement. Vimonto provides the identity of the entity engaged for a particular processing activity and the relevant location and transfer details on request before that processing is authorised. This information forms part of the processing information supplied under the DPA.
2 OpenRouter model providers
OpenRouter routes a request to a model provider; identifying OpenRouter alone does not identify every recipient. The model provider and relevant route information must be disclosed to the customer before Customer Personal Data is sent. A displayed model name alone does not suffice if a different organisation operates the inference endpoint.
Only providers covered by the DPA’s general authorisation and notice procedure, or by the customer’s specific informed written or electronic authorisation, may receive Customer Personal Data. If the necessary recipient information or safeguards are unavailable, the affected feature must not process Customer Personal Data. Automatic fallback routing cannot override this restriction. A customer’s specific request to use a clearly identified additional provider is recorded as an instruction and specific authorisation; it is not blanket authorisation for undisclosed providers.
The register does not authorise model training on Customer Personal Data. Provider contracts, account settings and route restrictions must give effect to that limitation. General provider privacy pages explain potential practices but are not, by themselves, a processor agreement or proof of the actual configuration.
3 Independent services and other recipients
| Provider | Purpose and role |
|---|---|
| Polar Software, Inc., or the Polar entity identified at checkout | Merchant of record and authorised reseller for Polar purchases; processes payment, billing, tax, refund and fraud information under its own responsibilities. It is not a processor of your server contents merely because it handles payment |
| Google sign-in | Identity information you authorise Google to share with Deploy; Google remains responsible for its own account and identity-service purposes |
| Google Analytics | Consent-based website measurement; a processor or other recipient for the applicable analytics activities, rather than a general recipient of server credentials or project contents |
| AppSumo, where a Deploy deal is offered and purchased | Marketplace purchase, redemption, entitlement and refund administration under the specific deal. Customers who do not use that channel are not disclosed to it merely because a listing is contemplated |
| Openprovider | Registration and management of Vimonto’s own domain name. Deploy does not register customer domains through Openprovider, and this use does not require sending it customer project contents |
Providers you independently purchase and connect, such as DigitalOcean and repository or backup providers, are governed by your own contracts. They are not automatically Vimonto’s subprocessors just because Deploy connects to their API or your server.
4 Provider documentation
| Provider | Privacy and service information |
|---|---|
| Hetzner | Privacy and company contact |
| AWS | Data privacy and transfer safeguards |
| Privacy Policy, Google Workspace processing terms and the terms for the particular Google service used | |
| OpenRouter | Privacy Policy and model-provider logging information |
| OpenAI | Privacy Policy and the processing terms applicable to the business service account |
| Anthropic | Privacy Policy and the processing terms applicable to the business service account |
| Polar | Privacy Policy and Buyer Terms |
| Openprovider | Privacy Policy |
| AppSumo | Terms of Use and the specific deal’s disclosures |
5 Transfers and changes
Deploy’s primary application data and platform backups are hosted in the EU. External email, identity, payments, analytics and AI can involve international processing and remote access. We require a valid transfer mechanism for restricted transfers for which we are responsible, together with any necessary assessment and additional safeguards. A provider’s headquarters or EU billing entity alone does not establish data residency.
We notify customers directly at least 30 days before adding or replacing a generally authorised subprocessor that will receive Customer Personal Data. The DPA provides an opportunity to object on reasonable data protection grounds before access. Specific informed authorisation requested by the customer is handled separately as described above. A silent webpage update does not replace required notice. Dated register versions are retained with the applicable agreement records.