Legal
Sub-processors
Last updated: 12 July 2026
These are the third parties StructQ Ltd engages to process personal data on behalf of StructLine customers, as authorized under section 5 of the data processing agreement. The list is short: detection runs on the device, hosting stays inside the EU, and the product contains no third-party analytics or advertising tools. Website analytics and visitor identification, which visitors can decline, are covered by the website privacy notice.
Current sub-processors
These providers process customer service data in delivering StructLine. Hosting is operated for us by Inoqube d.o.o. on Hetzner infrastructure in Germany; service data is stored and processed at rest within the EU, and traffic in transit passes through Cloudflare’s network.
| Sub-processor | Purpose | Personal data involved | Location & transfer safeguard |
|---|---|---|---|
| Inoqube d.o.o. | Managed hosting: operates the servers running the StructLine backend, database and dashboard on our behalf | All service data (org-scoped, per the customer’s privacy mode) | Slovenia (EU) |
| Hetzner Online GmbH | Data-center infrastructure on which the service is hosted (engaged via Inoqube d.o.o.) | All service data (org-scoped, per the customer’s privacy mode) | Germany (EU) |
| Cloudflare, Inc. | Content delivery network, DNS, TLS and DDoS protection in front of our websites and the StructLine service | Traffic in transit (TLS), including IP addresses and request metadata; in opt-in collection modes this includes transmitted content | United States, global network (EU–US DPF / SCCs) |
| Clerk, Inc. | Authentication and sign-in for dashboard users | Name, work email, authentication identifiers | United States (SCCs / UK Addendum) |
| Railsware Products Studio (Mailtrap) | Transactional email: finding alerts, invitations, service notifications | Recipient name and email, notification metadata | EU / United States (SCCs / UK Addendum) |
Notes
The optional AI detection stage runs on an open-weights model on servers we control. We do not engage any external AI service as a sub-processor; section 5 of the DPA records this commitment.
Corporate email and accounting providers (Microsoft 365, for example) process correspondence and invoicing records that StructQ Ltd holds as controller. They receive no customer service data, so they appear in the product privacy notice rather than on this list. Stripe, our payment provider, is in the same category: it processes billing data (billing contact, billing address, VAT number, and payment card details, which Stripe alone holds) for which StructQ Ltd is the controller, and it receives no workforce monitoring data. The same applies to Calendly, which schedules demos on our website and is covered by the website privacy notice.
Changes to this list
Before adding or replacing a sub-processor, we give customer administrators at least 30 days’ notice by email and update this page. Customers may object on reasonable data protection grounds under section 5 of the DPA. Questions: [email protected].