Sub-processors
This list of data processors engaged by bluepolicy/MeruX (Art. 28 GDPR) accompanies section 4 of our Privacy Policy.
| Service provider | Purpose | Location | Legal basis |
|---|---|---|---|
| Microsoft Azure | Cloud hosting (VMs, database), Blob Storage, Key Vault | EU (West Europe) | Art. 46 GDPR (SCCs + EU DPA) |
| Microsoft Azure Entra ID (CIAM) | Identity management, authentication | EU / USA | Art. 46 GDPR (SCCs) |
| Azure Communication Services | Email OTP delivery | EU / USA | Art. 46 GDPR (SCCs) |
| Stripe Payments Europe, Ltd. | Payment processing, subscriptions | EU (Ireland) / USA | Art. 46 GDPR (SCCs) |
| Expo (Expo Inc.) | Push notifications | USA | Art. 46 GDPR (SCCs) |
| Apple Inc. (APNs) | iOS push notifications | USA (EU routing) | Art. 46 GDPR (SCCs) |
| Google LLC (FCM) | Android push notifications | USA (EU routing) | Art. 46 GDPR (SCCs) |
| OpenAI, Inc. | OCR / image analysis (optional feature) | USA | Art. 46 GDPR (SCCs) |
| Tibber AS | Dynamic electricity pricing (optional) | Norway (EEA) | Art. 45/46 GDPR |
| Apple App Store / Google Play | App distribution | USA | Own privacy policies / eigene Datenschutzerklärungen |
As of: Privacy Policy version 1.2, effective 2026-06-01. Questions: jens.schneider@bluepolicy.de