Sub-processors
This list of data processors engaged by bluepolicy/MeruX (Art. 28 GDPR) accompanies section 4 of our Privacy Policy.
| Service provider | Purpose | Location | Legal basis |
|---|---|---|---|
| Microsoft Azure | Cloud hosting (Container Apps, database, cache), Blob Storage, Key Vault | EU (Germany West Central) | Art. 46 GDPR (SCCs + EU DPA) |
| Microsoft Azure Entra ID (CIAM) | Identity management, authentication | EU / USA | Art. 46 GDPR (SCCs) |
| Azure Communication Services | Email delivery (monthly charging reports) | EU / USA | Art. 46 GDPR (SCCs) |
| Stripe Payments Europe, Ltd. | Payment processing, subscriptions | EU (Ireland) / USA | Art. 46 GDPR (SCCs) |
| Expo (Expo Inc.) | Push notifications; over-the-air app updates (EAS Update) | USA | Art. 46 GDPR (SCCs) |
| Apple Inc. (APNs) | iOS push notifications | USA (EU routing) | Art. 46 GDPR (SCCs) |
| Google LLC (FCM) | Android push notifications | USA (EU routing) | Art. 46 GDPR (SCCs) |
| Apple Inc. / Google LLC | Sign in with Apple / Google sign-in (verification of sign-in tokens) | USA | Art. 46 GDPR (SCCs) / EU-U.S. DPF |
| Cloudflare, Inc. | DNS, edge proxy and bot protection (Turnstile) for the website, web portals and, where enabled, the API | USA / global edge network | Art. 46 GDPR (SCCs) / EU-U.S. DPF |
| OpenAI, Inc. | OCR / image analysis (optional feature) | USA | Art. 46 GDPR (SCCs) |
| Tibber AS | Dynamic electricity pricing (optional) | Norway (EEA) | Art. 45/46 GDPR |
| Apple App Store / Google Play | App distribution | USA | Own privacy policies / eigene Datenschutzerklärungen |
As of: Privacy Policy version 1.4, effective 2026-10-01. Questions: support@bluepolicy.de