1. About this list

A sub-processor is a third party that Totalum, Inc. engages to process personal data on behalf of its customers as part of providing the Service. This page is Annex III of our Data Processing Addendum and is referenced by our Privacy Policy. Under the Data Processing Addendum you give us general written authorization to use the categories of sub-processors listed here, and we remain responsible to you for their performance.

The providers are listed by category. The name, legal entity and location of each provider in a category are available to customers on request at contacto@totalum.app.

Projects created since October 8, 2026 run on the current engine; Projects that run on Totalum's previous engine (“legacy Projects”) keep the previous infrastructure. Where a category serves only one of them, the table says so. Services you choose to connect yourself (for example a code repository or a design tool) process data under your own agreement with them and are not listed here.

2. Sub-processors of Customer Project Data

These providers may receive data from inside your Projects, for which you are the controller and we are the processor. Several of them are engaged only when you use the corresponding feature; the table says so.

Category	Purpose	Data involved	Location	Transfer mechanism
AI model providers	The AI agent that builds and modifies your Projects; speech-to-text when you dictate a prompt; drafting help on support conversations	Prompts, instructions, the Project's source code and files the agent works on, dictated audio and its transcript, support-conversation text. Never used to train models	United States	Standard Contractual Clauses (Decision 2021/914) with UK Addendum and Swiss amendments, or the EU-US Data Privacy Framework where the provider is certified
AI gateway	The built-in AI features your apps use (text, chat, images, video, speech and embeddings), only when your app uses them	What your app sends to the AI features and the generated output	United States	Standard Contractual Clauses (Decision 2021/914) with UK Addendum and Swiss amendments, or the EU-US Data Privacy Framework where the provider is certified
Cloud hosting, delivery, databases and storage	Hosting and delivery of published apps and previews; Project databases, files, backups, versions, logs and control data on the current engine	The published app and its assets, request data of its visitors, the Project's database contents, files, backups and logs	Worldwide edge network; databases near the app's users, or in the European Union for Projects created with EU data residency	Standard Contractual Clauses (Decision 2021/914) with UK Addendum and Swiss amendments, or the EU-US Data Privacy Framework where the provider is certified
Scalable database service	Databases of current-engine Projects that outgrow the standard database	The Project's database contents, backups and restore points	United States; European Union for Projects created with EU data residency	Standard Contractual Clauses (Decision 2021/914) with UK Addendum and Swiss amendments, or the EU-US Data Privacy Framework where the provider is certified
Build environment	Isolated environments in which the AI agent builds current-engine Projects, running only while the agent works	The Project's source code, dependencies, build output, working files and environment variables	United States and other regions	Standard Contractual Clauses (Decision 2021/914) with UK Addendum and Swiss amendments, or the EU-US Data Privacy Framework where the provider is certified
EU infrastructure provider	Legacy Projects only: build environments, API nodes and database nodes	The complete legacy Project: source code, database contents, files, environment variables, build output and logs	European Union	No international transfer: processing within the EU
Object storage	Files and archives of legacy Projects; screenshots of published apps; support attachments	Uploaded files, source-code archives, agent run logs, page screenshots, files you attach to support conversations	United States, with European service entities	Standard Contractual Clauses (Decision 2021/914) with UK Addendum and Swiss amendments, or the EU-US Data Privacy Framework where the provider is certified
Email delivery	Email sent by your apps through the built-in email feature, only when your app sends email	Recipient addresses, subject and body of the emails, delivery events	United States	Standard Contractual Clauses (Decision 2021/914) with UK Addendum and Swiss amendments, or the EU-US Data Privacy Framework where the provider is certified
Screenshot service	Fallback for the thumbnail screenshot of your published app	The public address of your published app and the rendered image	European Union	No international transfer: processing within the EU
Web scraping and search	Scraping, crawling and web search, only when your app uses that feature	The addresses and queries your app sends and the content returned	United States	Standard Contractual Clauses (Decision 2021/914) with UK Addendum and Swiss amendments, or the EU-US Data Privacy Framework where the provider is certified
Cloud browser	Browser sessions run by your app, only when your app uses that feature	The pages your app visits, the data it enters and the session output	United States	Standard Contractual Clauses (Decision 2021/914) with UK Addendum and Swiss amendments, or the EU-US Data Privacy Framework where the provider is certified
Mobile app builds	Builds of the Android and iOS apps of your Projects, only when you build a mobile app	The Project's source code, the signing credentials you set up, build logs and the built app	United Kingdom and European Union	Adequacy decision (United Kingdom); Standard Contractual Clauses where applicable
Payments in your app	Payments your app takes through the built-in payments feature, only when your app uses it	Payment events of your app's customers needed to record them in your Project	United States and European Union	Standard Contractual Clauses (Decision 2021/914) with UK Addendum and Swiss amendments, or the EU-US Data Privacy Framework where the provider is certified

3. Providers that process only Account data

These providers never receive the contents of your Projects. They process data about you as our customer, in our capacity as controller, for the purposes described in the Privacy Policy.

Category	Purpose	Data involved	Location	Transfer mechanism
Payment processing	Subscriptions, credit purchases, invoices, saved payment methods, taxes and fraud prevention	Name, email, billing address and country, tax id, payment-method details (held by the processor), transaction history	United States and European Union	Standard Contractual Clauses (Decision 2021/914) with UK Addendum and Swiss amendments, or the EU-US Data Privacy Framework where the provider is certified
Email delivery	Verification codes, receipts, account and project notices	Email address, name, the message and delivery events	United States	Standard Contractual Clauses (Decision 2021/914) with UK Addendum and Swiss amendments, or the EU-US Data Privacy Framework where the provider is certified
Domain registration	Registration, renewal and transfer of domain names you buy through Totalum, only when you buy one	The domain name and the registrant contact details you provide	United States	Standard Contractual Clauses (Decision 2021/914) with UK Addendum and Swiss amendments, or the EU-US Data Privacy Framework where the provider is certified
Bot and fraud protection	Bot and fraud detection on the sign-up form	IP address, browser and device signals, interaction data on the form	United States and European Union	Standard Contractual Clauses (Decision 2021/914) with UK Addendum and Swiss amendments, or the EU-US Data Privacy Framework where the provider is certified
Analytics and advertising measurement	Measurement of platform usage and of advertising conversions, subject to your consent where required (see the Cookie Policy)	Analytics and click identifiers, country, sign-up method, hashed email or phone, conversion events	United States and European Union	Standard Contractual Clauses (Decision 2021/914) with UK Addendum and Swiss amendments, or the EU-US Data Privacy Framework where the provider is certified
Scheduling	Booking a call with us, only if you use the booking link on our website	Name, email, chosen time and any notes you enter	United States	Standard Contractual Clauses (Decision 2021/914) with UK Addendum and Swiss amendments, or the EU-US Data Privacy Framework where the provider is certified

4. Infrastructure locations and government-access safeguards

This section provides the information required by Article 28 of Regulation (EU) 2023/2854 (the Data Act) about the jurisdiction of our ICT infrastructure and the measures we take against unlawful access by third-country authorities.

4.1 Where the infrastructure is

Current engine. Published apps are served from an edge network worldwide. Each Project's databases are placed near the app's users, with read copies in other regions, or, for Projects created with EU data residency, entirely inside the European Union together with their files and backups, never stored or processed outside it. Files, backups, logs and control data of other Projects are held by our cloud provider, established in the United States. Build environments run in the United States and other regions, only while the agent works.
Legacy Projects. Build environments, API nodes and database nodes run on infrastructure in the European Union; their files and archives are held in object storage in the United States, with European service entities.
Other processing. AI models, the AI gateway, payment processing, email delivery, the scraping and browser features, domain registration and advertising measurement are provided from the United States, and mobile builds from the United Kingdom and the European Union.

Data formats, export procedures and the switching terms that apply to customers in the European Union are described in Section 14 of the Terms of Service and in our documentation.

4.2 Measures against unlawful third-country government access

All data is encrypted in transit and at rest; access to production systems is restricted to named personnel with multi-factor authentication and is logged.
Each Project's data is kept in its own databases, separate from every other Project's.
We disclose Customer Project Data to a public authority only when legally compelled by a request that is valid and enforceable against us. We review every request and challenge requests that are overbroad, unlawful or outside the requesting authority's jurisdiction, and we disclose only the minimum required.
Unless legally prohibited, we notify the affected customer before disclosing their data, or as soon as the prohibition is lifted.
We assess each sub-processor's exposure to government-access laws and rely on the Data Privacy Framework or the Standard Contractual Clauses with supplementary measures as appropriate. A summary of the assessment is available to customers on request.
AI model providers process prompts and code to answer the request and are contractually barred from using them to train models.

5. Notice of changes and how to object

Before we add a new category of sub-processor of Customer Project Data, or a new provider within a category, or change the purpose for which a provider is used, we will update this page at least 30 days before the change takes effect, and customers who have asked for the named list will receive the updated list. If you have a reasonable, documented data-protection objection, write to contacto@totalum.app before the change takes effect. We will work with you to address the objection; if we cannot, you may terminate the affected Project or your Account without penalty and receive a pro-rata refund of any prepaid subscription period, and the export rights in the Terms apply.

6. Change log

Date	Change
January 1, 2026	Initial publication of the sub-processor list with the Data Processing Addendum.
October 7, 2026	Current engine: added the AI gateway, scalable database service, build environment, web scraping and search, cloud browser, mobile app builds, payments in your app, email delivery and domain registration categories; the list is now published by category.