Sub-processors
Last updated: July 28, 2026
To run AllMy Support (the "Service"), CoinsTax LLC, doing business as AllMy ("AllMy"), uses a small number of third-party providers. Each is bound by a written data processing agreement that requires it to protect the data and to process it only on documented instructions; each provider's agreement is linked in the tables below. The first table below lists the sub-processors that may process personal data contained in Customer Content on our behalf under our Data Processing Addendum. The second table lists other providers we use for personal data we hold as a controller (our own account, billing, and analytics data); these do not process Customer Content.
This page is referenced by our Data Processing Addendum and should be read with our Privacy Policy. Capitalized terms have the meaning given in our Terms and Conditions and the DPA.
Sub-processors (Customer Content)
| Provider | Purpose | Location | Transfer basis |
|---|---|---|---|
| Hetzner Online GmbH Customer Content and account data, at rest and in processing. | Hosting, compute, the primary application database, and object storage (ticket attachments, inline images, and raw email files). | Germany and Finland (EU) | Stored in the EU. Accessed by AllMy personnel from the United States; see International transfers below. Hetzner data processing agreement |
| Amazon Web Services (AWS) Inbound email content and headers, and any Customer Content or account data processed on AWS. | Receiving inbound support email (SES, us-east-1), and hosting, compute, the primary application database, and object storage where used. AllMy's own transactional email to admins and agents is also sent through SES. Customers' outbound replies are sent through each customer's own email provider, not through AWS. | United States (us-east-1), and the EU where used | Processed in the United States. AWS's GDPR data processing addendum, part of the AWS Service Terms, incorporates the EU Standard Contractual Clauses. AWS GDPR data processing addendum |
| Cloudflare, Inc. Traffic metadata and content in transit, served assets, and any Customer Content processed on Cloudflare. | Edge network, CDN, DNS, hosting of our web and application front end, and object storage where used. | Global network (United States, EU, and other regions) | Processed across a global network, including the United States. Cloudflare's data processing addendum incorporates the EU Standard Contractual Clauses. Cloudflare data processing addendum |
Other providers (our own controller data)
These providers process personal data we hold as a controller. They do not process Customer Content and are not sub-processors under the DPA. We list them here for transparency.
| Provider | Purpose | Location | Transfer basis |
|---|---|---|---|
| Stripe, Inc. Account and billing details of subscribing businesses. | Subscription billing and payment processing. | United States | Stripe's data processing agreement, part of the Stripe Services Agreement, incorporates the EU Standard Contractual Clauses. Stripe data processing agreement |
| Google (Google Analytics) Usage and device data of visitors and agents. | Website and product usage analytics, set only where consent is given. | United States | The Google Ads Data Processing Terms incorporate the EU Standard Contractual Clauses. Google Ads Data Processing Terms |
International transfers
AllMy's personnel are located in the United States and access personal data from there, and AllMy and its sub-processors may process personal data in the EU and the United States, as shown in the tables above. Where a provider's processing involves a transfer of personal data out of the UK or EEA to a country without an adequacy decision, including the United States, that provider's data processing agreement, linked in the tables above, incorporates the European Commission's Standard Contractual Clauses and, where applicable, the corresponding UK addendum.
Notice of changes
When we intend to add or replace a sub-processor that processes Customer Content with a provider not already listed above, we will give workspace owners at least 30 days' notice before the change takes effect, and we update the "Last updated" date and the list. If you have a reasonable objection on data-protection grounds, contact us during the notice period and we will work with you in good faith, up to and including allowing you to terminate as described in the DPA.
Moving processing between sub-processors that are already listed above, or between the regions of a listed sub-processor, does not require separate notice, provided the protections in our DPA (including any transfer safeguards) continue to apply. The providers above are authorized for the purposes and locations shown, and we may distribute or shift workloads among them.
Contact
Questions about our sub-processors? Contact us at privacy@allmy.support.