Legal
Subprocessors
Last updated: November 1, 2026
To run The Black Line we work with a small number of service providers that may process personal data that studios store in the Service (their clients' data). Each one is bound by a data processing agreement with obligations equivalent to our Data Processing Agreement with you.
Your data lives in Germany. We keep this list short on purpose.
Current subprocessors
| Provider | What they do for us | Data | Where | Transfer safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH · Gunzenhausen, Germany | Servers, database and file storage | All studio data | Germany (Falkenstein) | Within the EU |
| Anthropic Ireland, Limited · Dublin, Ireland (Anthropic PBC, USA) | AI features, only when a studio uses them | The text needed for each request (for example an inquiry or a template); no files or photos. Not used for training; deleted within 30 days | USA | Standard Contractual Clauses |
| Google Cloud EMEA Limited · Dublin, Ireland (Google Workspace) | Sending platform emails (account, invitations, notices) | Recipient address and email content | EU / USA | EU-US Data Privacy Framework; Standard Contractual Clauses |
Services you connect yourself
These are not our subprocessors. You choose them, and they work for you or on their own responsibility:
- Your email provider, when the Service sends emails from your studio address.
- Stripe and PayPal, when your clients pay you by card or PayPal. Money goes to your account, never through us.
- Google Calendar and Sign in with Google (Google LLC, under Google's API terms).
- MailerLite or other newsletter tools you connect.
- Your own AI assistant (Claude, ChatGPT or others) connected through our MCP server or API keys.
Providers that never see your clients' data
- Stripe Payments Europe, Ltd bills your subscription to The Black Line (we are the controller; see our Privacy Policy).
- CoinGecko and Kraken: we read public Bitcoin exchange rates; no personal data is sent.
- GitHub: hosts our source code and software images; no customer data.
Changes
We tell studio owners by email at least 30 days before we add or replace a subprocessor. You can object within 14 days, as described in section 6 of the DPA. Studio owners receive these notices automatically.
Previous versions
| Date | Change |
|---|---|
| November 1, 2026 | First version |