Data Processors (subprocessors)
Effective from: August 10, 2026
This overview describes suppliers and recipients of personal data used by FixIt.app s.r.o. (Company ID 23725681). It supplements our Privacy Policy. It also includes independent controllers and tools we operate ourselves: a self-hosted Sentry or Umami installation is not another external company. The role of payment and identity services depends on the specific activity.
I. Infrastructure and Hosting
| Supplier or tool | Purpose and data | Location |
|---|---|---|
| Hetzner Online GmbH | Application, API and database hosting; storage of contracts, signed documents, OSH (BOZP) records, certifications and CVs (Object Storage, Falkenstein) | Germany (EU) |
| Amazon Web Services - S3 and CloudFront | Storage of public images and of chat and support attachments; delivery of public images via CDN | Frankfurt (eu-central-1); CDN edge servers in the EU; international provider |
| Sentry - self-hosted | Error reports, account identifier, email and technical context; on an error, a short masked screen recording (Session Replay) | Own infrastructure in the EU |
II. Payments and Identity Verification
| Processor | Purpose | Location |
|---|---|---|
| Stripe (Stripe Payments Europe, Ltd. and affiliated companies) | Payment processing (Connect Express, Customers, Billing) | EU / USA |
| Bank iD | Identity verification (bank identity, OIDC) | Czech Republic (EU) |
| Bank iD SIGN | Advanced electronic document signatures and Bank iD's qualified seal | Czech Republic (EU) |
III. Processing of Content by Artificial Intelligence
| Provider | Purpose and data | Transfers |
|---|---|---|
| OpenAI | Text and context of AI requests | Also outside the EU/EEA, particularly the USA |
| Anthropic | Text, context and uploaded photos and documents of AI requests | Also outside the EU/EEA, particularly the USA |
| Google - Gemini | Text prompts for image generation (no user photos) | Also outside the EU/EEA, particularly the USA |
| OpenRouter | Routing some requests to models | USA and the downstream provider's infrastructure |
AI supports job processing, content creation and the Fixáček assistant. Transmitted content can include messages, images, conversation history and related context. Our Eve service routes requests; not every request passes through OpenRouter or reaches every listed provider. See Privacy Policy, Art. IV.
IV. Sign-in, Notifications, and Communication
| Provider | Purpose and data | Location / transfers |
|---|---|---|
| WorkOS | Sign-in, account identifiers and email | USA |
| Sign-in; map tiles and reverse geocoding in the Android app (Google Maps); notification delivery to Android devices | EU / USA | |
| Mapbox | Address search, maps and routing; queried address or coordinates; fallback reverse geocoding in the app | International infrastructure including the USA |
| Apple | Sign-in; map tiles and reverse geocoding in the iOS app (Apple Maps); notification delivery to Apple devices | EU / USA |
| Expo | Push tokens and notification content; delivery through Apple and Google services | USA and Apple/Google infrastructure |
| Cloudflare Turnstile | Bot protection for forms and public AI chat; technical device and connection signals | Global infrastructure including the EU / USA |
| Amazon Web Services - SES | Email delivery: recipient address, message content and delivery status | Frankfurt, Germany (eu-central-1); international provider |
| Twilio | Verification SMS: phone number, message text and delivery status | International infrastructure including the USA and mobile operators |
| Telegram | Internal operational alerts and their context | Outside the EU/EEA according to the service's infrastructure |
V. Analytics
| Tool | Purpose | Location |
|---|---|---|
| Umami - self-hosted | Traffic analysis without analytics cookies | Own infrastructure in the EU |
VI. Statutory Recipients (Public Authorities)
The following authorities are not processors but recipients of data on the basis of legal obligations (this concerns in particular workers on DPP/DPČ - see Cooperation Terms for Workers):
| Recipient | Purpose |
|---|---|
| Czech Social Security Administration (ČSSZ) | Unified monthly employer reporting (JMHZ), employee registration (REGZEC) and employer registration |
| Financial Administration | Tax administration and statutory reports |
| Worker's health insurance company | Employer's bulk notification (registration and deregistration) and monthly insurance premium statement; the insurer is identified by the code the worker provides |
VII. Transfers Outside the EU/EEA
We transfer some data outside the EU/EEA. This concerns sign-in, AI, notifications and SMS in particular. Hosting our server or storage in the EU does not itself mean that all related processing takes place only in the EU.
The WorkOS addendum includes standard contractual clauses for relevant international transfers. Expo's terms cover user-data processing and contractual safeguards. For other services, the applicable terms depend on the specific product, agreement and processing route; a provider's registered location or a link to its privacy policy alone is not evidence that every transfer is protected.
You can request information about safeguards applicable to your data and a copy of them at legal@fixit.app.
VIII. Changes to the List
We update this list on an ongoing basis. We inform of significant changes to the range of processors in the manner set out in the Privacy Policy.
Last updated: September 20, 2026