These are the companies that process personal data for Saudad, which ANDGINJA DIGITAL SERVICES, LDA runs. Each one processes it only to provide its service to us, under its data protection terms. Our privacy policy says what we collect and why, and our data processing agreement covers personal data you store for your business.
We will update this page at least 30 days before we add or replace a sub-processor, and email account holders about the change. Questions about this list: andre@andginja.com.
The list
| Sub-processor | What it does for Saudad | Personal data involved | Where |
|---|---|---|---|
| Hetzner Online GmbH | The server Saudad runs on: the website, the agents’ connection point, the databases holding accounts and memories, the job scheduler, the visit counter for the public pages (PipeTrace, our own), and the temporary files of backups being made. The server is shared with other services we run, each in its own containers | Everything Saudad holds: account data, sessions, memories and notes, connection records, billing status | Data centre in Nuremberg, Germany. No transfer outside the European Economic Area |
| Cloudflare (proxy, DNS, network security) | Runs the saudad.ai domain; every request from browsers and agents passes through Cloudflare’s network | IP addresses, request headers and the content of requests and responses in transit, including memory text and email addresses | Cloudflare’s global network, including the United States |
| Cloudflare (R2 storage) | Stores the nightly backups and people’s exports | Backups of every database and exports of memories, all encrypted before upload with keys Cloudflare does not hold | Cloudflare’s network |
| OpenAI | Embeddings: turns text into numbers so search works by meaning. No chat model is used | The text of memories and notes, and search queries | United States |
| Resend | Sends Saudad’s emails: sign-in codes, invites, “tell me when it’s ready” confirmations, and billing notices once paid plans open | Email addresses and the content of those emails | United States |
| Google (Google Workspace) | Hosts our email at andginja.com and saudad.ai: the inbox that receives what people send us, including replies to our emails. Support mail only | Email addresses and the content of messages people send us | Google’s data centres, including the United States |
| Stripe | Payments, subscriptions, VAT calculation and the billing portal. Only once paid plans open; not in use today | Name, email, billing address, VAT number if given, card details (held by Stripe only), subscription and payment history | Ireland and the United States |
| InvoiceXpress | Portuguese invoices, which we issue by hand. Only once paid plans open; not in use today | Name, billing address, VAT number, amounts | Listed here, with where it keeps data, before we start using it |
Where data leaves the European Economic Area, we rely on the EU–US Data Privacy Framework where the company is certified, or on the European Commission’s standard contractual clauses.
Not sub-processors
- The AI apps you connect (Claude, ChatGPT, Claude Code, Codex, Cursor, OpenClaw and others). You choose to connect them and they act for you, under your own agreement with their provider. Saudad doesn’t send them data by itself.
- Software we run ourselves on our own server, such as our deployment tool and job scheduler: no outside company has access through it.
- PipeTrace, which counts visits to our public pages without cookies or any identifier: our own analytics software, run by ANDGINJA DIGITAL SERVICES, LDA on the same Hetzner server in Nuremberg, Germany. No other company receives what it records. The privacy policy says what it records.
- Our accountant and the Portuguese tax authority receive billing records because the law requires it; they are recipients, not sub-processors.