Subprocessors
Last updated: July 8, 2026
To deliver the Publano service, Koya Labs engages the third-party subprocessors listed below. Each processes personal data only as needed to provide its function, under a written data processing agreement with terms consistent with our Data Processing Agreement. We update this page before adding or replacing a subprocessor that processes customer personal data. To be notified of changes, email [email protected].
1. Infrastructure and service subprocessors
These providers process personal data on our behalf to operate, secure, and support the Service.
| Subprocessor | Purpose | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH | Cloud hosting — application servers, database, cache, self-hosted CMS | All service data at rest (accounts, workspace content, encrypted tokens, media metadata, logs) | Germany (EU) | EU/EEA — no transfer mechanism required |
| Cloudflare, Inc. | CDN, WAF/DDoS protection, DNS, R2 object storage for media, Zero Trust access to admin | Request metadata, IP addresses, uploaded media files | USA / global edge network | EU Standard Contractual Clauses; EU–US Data Privacy Framework certified |
| Resend (Plus Five Five, Inc.) | Transactional email delivery (sign-in links, invitations, notifications, digests) | Recipient email addresses, email content | USA | EU Standard Contractual Clauses |
| Functional Software, Inc. (Sentry) | Application error monitoring and performance diagnostics | Technical error/diagnostic data; limited session context and user identifiers where an error occurs | USA | EU Standard Contractual Clauses |
| Google LLC (Gemini API / Google AI) | AI generation of captions, calendar plans, and campaign briefs at the user's request | Prompt inputs: draft captions, media frames, client name, tone samples, content parameters | USA | EU Standard Contractual Clauses; EU–US Data Privacy Framework. Processed under Google API terms that do not use the data to train Google's models. |
| Google LLC (Google Analytics & Tag Manager) | Marketing-website analytics — only when the visitor consents | Marketing-site usage and device data (consent-gated) | USA | EU Standard Contractual Clauses; EU–US Data Privacy Framework. Loaded only after cookie consent. |
| Infisical, Inc. | Secrets and configuration management | Application secrets and API credentials only — no customer personal data | EU region | EU/EEA — no transfer mechanism required |
| Adyen N.V. | Payment and subscription processing (once paid billing is enabled) | Billing contact and transaction data. Card details are handled by the processor and are not stored by us. | Netherlands (EU) | EU/EEA — no transfer mechanism required |
2. Connected platforms (independent controllers)
When you connect a social or analytics platform, that platform receives content and grants access at your instruction under its own terms and privacy policy. These platforms are independent controllers, not our subprocessors, and are listed here for transparency.
Meta (Instagram & Facebook)
Publishing to Instagram Business accounts and Facebook Pages; page insights; comment management.
Privacy policyGoogle (YouTube, Business Profile, Analytics 4, Search Console)
Video publishing, business-profile management, and analytics access you authorize.
Privacy policy3. Contact
Questions about our subprocessors or data transfers can be sent to [email protected].