Sub-processors and other service providers
Version 1.0 · In force since November 10, 2026
Translation for convenience. The German version of this document is the binding one. If the English text differs from the German, the German text applies.
Martini Software GmbH · As of: 10 November 2026 · Version 1.0 (translation)
On this page we name the service providers that process or receive personal data for Martini. Part 1 lists the sub-processors that process the project data of your production. They are listed in Annex IV of our data processing agreement (AVV). Part 2 lists other service providers that do not process project data. Part 3 says how we maintain this page and how we inform you of changes. Part 4 is the change log.
Part 1. Sub-processors for project data
| Service provider | Task | Data | Place of processing | Basis for transfer to a third country | Agreement since |
|---|---|---|---|---|---|
| Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513 | Database and sign-in | Accounts, Projects, memberships, schedules, invitations | Data centre in Frankfurt; Supabase and its sub-processors may access the data from outside the EU | Standard contractual clauses of the European Commission, Module Three (Martini, as processor, transfers project data to a sub-processor) | 2026-08-17 |
| Fly.io, Inc., 2045 W Grand Ave Ste B, Chicago, Illinois 60612, USA | Operation of the interface (API) and the web portal; background tasks | Requests and responses, temporary technical logs | Data centre in Frankfurt | Participation in the EU-U.S. Data Privacy Framework | 2026-09-16 |
| Sendinblue SAS (Brevo), 9-17, rue Salneuve, 75017 Paris, France | Sending of e-mails | Recipient address, subject, content, delivery status | France (EU) | No transfer by Martini | 2026-08-15 |
| 650 Industries, Inc. (Expo), 624 University Ave FL1, Palo Alto, CA 94301, USA | Forwarding of push notifications | Push token, title and text of the notification | USA | Participation in the EU-U.S. Data Privacy Framework; in addition, standard contractual clauses under Expo's terms of use (which provide only for Module Two) | Expo's terms of use, without separate countersignature |
| Scaleway S.A.S., 8 rue de la Ville l'Évêque, 75008 Paris, France | Key management for the keys that protect stored credentials and access codes; no access to readable personal data | Key material | EU | No transfer | 2026-10-15 |
The service providers in turn use further sub-processors. You can find their lists here: Supabase at supabase.com/legal/customer-resources/subprocessor-list; Expo at expo.dev/privacy/subprocessors; Fly.io at fly.io/legal/sub-processors; Brevo in Annex 2 of its data processing agreement (brevo.com/legal/termsofuse). We are liable to you for them as for our own service providers (clause 7.7 (d) of the AVV).
Apple and Google deliver the push notification that Expo hands to them and, in the case of a pre-release version, receive the e-mail addresses of the contributors whom a production names for it; in doing so they act under their own responsibility (Part 2).
Part 2. Other service providers without access to project data
| Service provider | Task | Data | Why not a sub-processor for project data |
|---|---|---|---|
| Stripe Payments Europe, Limited (contracting party) and Stripe Technology Europe, Limited (payment service provider), both Dublin, Ireland | Payment, tax calculation and invoicing | Company name, e-mail address of the account, country and billing address of the buyers, VAT ID, order number, payment data (only at Stripe) | Concerns the buyers' data, not project data; Stripe processes part of it under its own responsibility |
| Functional Software, Inc. (Sentry) | Crash reports and error monitoring | Technical data without project content; reports in the EU, administrative data of our account in the USA | Error reports contain no content from Projects |
| Hetzner Online GmbH, Germany | Hosting of Martini's website and e-mail mailbox | Access data of the website, e-mails to Martini | Not part of the processing of project data |
| GitHub | Management of the source code and automated tests | Source code; access keys for deployment | Does not process Users' personal data |
| OI Consulting GmbH, Berlin | Bookkeeping | Invoices and accounting records | Concerns the buyers' data, not project data |
| Apple and Google | Delivery of the push notification to the device; distribution of the app and the pre-release versions | Push token, text of the notification; for a pre-release version, the e-mail addresses of the named contributors | Act under their own responsibility when delivering, according to their own terms |
| Supabase Pte. Ltd., Singapore (storage in the Frankfurt data centre) | Storage of invoices | Invoices with the buyers' name, company, address, VAT ID and e-mail address | Concerns the buyers' data, not project data; same provider as in Part 1 |
Part 3. How we maintain this page
Who. The data protection contact person, Simon Riegel (privacy@martini-software.com), is responsible for this page.
New or replaced sub-processor for project data (Part 1). We announce the change by e-mail to the contact person named in the AVV and to the licence holder at least 30 days before the engagement. On the day of the announcement we add the change, with its planned start, to this page and to the change log. You can object until the 30 days have expired, without giving reasons. What then applies is set out in clause C3 of the AVV.
Other service providers (Part 2). We update the page before we use the service. If project data reaches the service provider in the process, the paragraph before this one applies instead.
Review. We review the page at every change. We keep earlier versions.
Part 4. Change log
| Date | Change | Start |
|---|---|---|
| 2026-11-10 | First version | — |
Version history
| Version | Date | Change |
|---|---|---|
| 1.0 | 2026-11-10 | First publication of the final text |