1.1 DPP Host is a service of Qubites ApS, Ulsøparken 49, 2. tv., 2660 Brøndby Strand, Denmark, CVR 37061026 ("Qubites"). Contact: privacy@dpphost.eu.
1.2 In this page:
"Brand" means a business that uses DPP Host through an organisation in the dashboard.
"Processor Data" means personal data that Qubites processes on a Brand's behalf, as its processor, under the DPA.
"Owner Data" means the Processor Data of owner services, as described in DPA Annex I part A.
"DPA" means the data processing agreement between the Brand and Qubites.
1.3 Part 2 lists the Sub-processors: providers that process Processor Data for Qubites (GDPR Art. 28(2) and (4)). Part 3 lists the providers Qubites uses for personal data it processes as controller, for example dashboard accounts, emails to and from Qubites, and billing. Part 4 lists recipients that are neither.
1.4 Many providers appear in both part 2 and part 3, because the same service runs both kinds of data.
1.5 Qubites gives a Brand, on request to privacy@dpphost.eu, the name, location and role of every provider in the chain, including each provider's own sub-processors.
2. Sub-processors for Processor Data (Art. 28)
2.1 In use
Supabase
Legal entity
Supabase Pte. Ltd. (Singapore), as named in Supabase's DPA
Purpose
Database, sign-in (Auth), secret store (Vault), scheduled jobs, Edge Functions
Processor Data
All Owner Data, including sign-in identities, sessions and the sign-in event log; supplier contacts; personal data in the Brand's passports, pages, imports and approvals
Location
Database, Auth, Vault, scheduled jobs and Edge Functions: AWS eu-central-1, Frankfurt, Germany. Every call to an Edge Function is pinned to that region, and a function refuses a call that reaches it in another region. Remote access by Supabase staff outside the EEA is possible
Transfer mechanism
Standard contractual clauses (SCCs) in Supabase's DPA
Hosts the dashboard, the owner area, the REST API, the MCP server, the resolver and the other services; TLS, CDN and DNS; object storage (R2) for passports, images, supplier evidence, backups, the receipts shops add for their customers (kept for the owner) and the markers of items whose owners let finders message them (a hash of the item's path and an expiry); Turnstile bot check on sign-in pages and on the finder's form; Email Routing of privacy@ and hello@, and an email service that passes each message to the Microsoft 365 and Gmail mailboxes; connection pooling (Hyperdrive) to the database
Processor Data
Owner Data in transit through the owner area and the REST API; IP address and browser signals at sign-in and on the finder's form (Turnstile); messages from owners and suppliers sent to privacy@ or hello@; supplier evidence files; owners' receipts (read and written only by the service that keeps them); personal data in the Brand's published content
Location
Global network: requests are handled at the data centre nearest the visitor. The storage buckets for passports, images, supplier evidence, backups, receipts and the finders' markers are in the EU jurisdiction
Transfer mechanism
EU-US Data Privacy Framework (DPF); SCCs (Implementing Decision (EU) 2021/914) in Cloudflare's DPA
Sends sign-in and confirmation emails to owners, the care reminders owners turn on, requests and reminders to the Brand's suppliers, and notices to the Brand's admins
Processor Data
Owner email address and one-time sign-in link; for care reminders the owner's address and language, the Brand's text, the item and a stop link; supplier contact's email address and the request link; item identifiers and references in notices to the Brand (pseudonymous)
Location
Sends from the EU region (Ireland), which decides routing only. Stored data, including email and log data, is held in the United States and kept 30 days (Resend's security page, read 2 Oct 2026)
Microsoft Ireland Operations Limited, Microsoft's contracting entity for customers in the EEA; bought through GoDaddy, Microsoft's reseller
Purpose
Mailbox that receives mail sent to privacy@dpphost.eu and hello@dpphost.eu (passed on by Cloudflare's email service, which also passes it to Gmail, below)
Processor Data
Any message an owner or a supplier sends to Qubites, for example a data subject request that Qubites passes on to the Brand (DPA clause 9.3)
Location
European Union (the account's region with Microsoft)
2.2 Built and switched off (not authorised until notice under part 5)
Anthropic (Claude API)
Legal entity
Anthropic Ireland, Limited (Ireland), Anthropic's contracting party for customers in the EEA, with Anthropic, PBC (USA)
Purpose
New passport's reading: reads, once, the files (PDF, photos) or the product page a Brand's member drops on New passport, with Anthropic's Claude model, to suggest the values a passport needs with the file, page and quote each came from. A person confirms every value. GTIN claim documents: reads, once, the GS1 licence certificate or membership invoice an admin adds to a GTIN claim, for the company details DPP Host checks the claim against
Processor Data
Any personal data in those files or that page, for example a contact person named on a data sheet or a maker's address (DPA Annex I part D); on a GS1 document, a contact person it may show (only the company's details are kept)
Location
The United States and other countries where Anthropic runs its service. Anthropic deletes the files, the page and the answer within 30 days. Content that its automated checks flag as breaking its usage policy may be kept for up to 2 years. Anthropic does not use the content to train models
Transfer mechanism
The European Commission's SCCs (Module Two and Module Three), part of Anthropic's DPA
Off-site copies: a nightly encrypted copy of the database, and a nightly copy of the published passports
Processor Data
Database copy: all Owner Data except the sign-in identity, and all other Processor Data in the database. Passport copy: only what the public passport pages show
Location
Paris, France (fr-par)
Transfer mechanism
None needed if there is no access from outside the EEA; being confirmed in Scaleway's DPA
Functional Software, Inc. (USA), trading as Sentry
Purpose
Error reports from the dashboard and the owner area
Processor Data
An error report can contain the page address, including the Brand's owner-area handle. It is set up to send no user details, cookies, headers, bodies or query parameters
2.2.1 The off-site copies stay off until real customers exist. Before they go on, Qubites gives notice under part 5, and the privacy notice changes the backup period from "up to 7 days" to "within 6 weeks".
2.2.2 Error reporting stays off: it is not part of the dashboard as it is built today. Before it is switched on, Qubites gives notice under part 5.
2.2.3 New passport's reading sends nothing to Anthropic until Qubites has stored the key of its Anthropic account. Then a setting decides which organisations read: none (the default), only Qubites' own organisations (Qubites ApS, the DPP Host demo and Example Cycles, with Qubites' own content, no Brand's), or every organisation. A Brand's files reach Anthropic only under the last, which Qubites switches on no earlier than the day the notice under part 5 gives, and from that day the site's privacy notice names Anthropic. DPP Host keeps no copy of the files or the page: they are read in memory and dropped with the request. Amazon Web Services (Amazon Bedrock), announced on 12 October 2026, will not be used: Anthropic replaces it, under a notice of its own (5.8).
2.3 Planned (not built into the live service)
These are not authorised until Qubites gives notice under part 5 and the DPA addendum for wallets (DPA Annex I part B) is signed:
a paymaster and bundler service for sponsored blockchain fees (Pimlico, or Alchemy as the alternative), its entity and location still to be confirmed;
a blockchain RPC node provider, still to be chosen;
a key management service for the Brand's minter key, still to be chosen;
a WalletConnect relay, if one is used under DPP Host's project id, still to be decided.
No token contract is registered and the minter is not deployed. Nothing is written to a blockchain for any Brand.
3. Providers Qubites uses as controller
Supabase
Legal entity
As in part 2.1
Purpose
Database and sign-in for Qubites' own records. The sign-in address auth.dpphost.eu is Supabase's custom domain, served through Supabase's own Cloudflare set-up, which sets the bot-management cookie __cf_bm (30 minutes) on that host; a browser keeps it on a Google, Apple or Microsoft sign-in
Personal data
Dashboard accounts (name, email, password hash, language, memberships, sessions with IP address and browser), invitations, the organisations' action log, business verification and GTIN claim records, API key and MCP connection records, the email queue, DSA notices, billing contacts (once billing is live), the owner sign-in identity
Location
As in part 2.1
Transfer mechanism
SCCs in Supabase's DPA
DPA
As in part 2.1
Cloudflare
Legal entity
As in part 2.1
Purpose
Delivers dpphost.eu and app.dpphost.eu; request logs; Turnstile; Email Routing and the email service that passes mail on; storage of MCP connection grants (Workers KV); the Shopify app's per-shop storage (encrypted shop tokens, item state; no jurisdiction setting); rate-limit counters per IP address for 60 seconds (API, MCP, forms); DNS lookups for domain proofs and webhook checks (DNS over HTTPS)
Personal data
IP address and request data; browser and device signals (Turnstile); emails to hello@ and privacy@ in transit; MCP grant records with the member's user id and organisation id (the grant details encrypted)
Location
Global network; Workers KV has no EU jurisdiction setting
Transfer mechanism
DPF; SCCs in Cloudflare's DPA
DPA
As in part 2.1
Resend
Legal entity
As in part 2.1
Purpose
Sends account emails (address confirmation, sign-in codes and links, password resets) and service emails (billing, verification and GTIN claim decisions, exports, webhook and shop-connection notices, notices of new sub-processors)
Personal data
Recipient email address, and what the email says
Location
As in part 2.1: sends from the EU region (Ireland) and keeps each email and its sending log in the United States for 30 days
Transfer mechanism
DPF; SCCs in Resend's DPA
DPA
As in part 2.1
Microsoft 365
Legal entity
As in part 2.1
Purpose
Qubites' mailbox for hello@ and privacy@
Personal data
Name, email address and content of emails to Qubites
Location
As in part 2.1
Transfer mechanism
As in part 2.1
DPA
As in part 2.1
Google (Gmail)
Legal entity
As in part 2.1
Purpose
Qubites' second mailbox for hello@ and privacy@ (consumer Gmail, since 2 Oct 2026)
Personal data
Name, email address and content of emails to Qubites
Location
As in part 2.1
Transfer mechanism
As in part 2.1: none agreed
DPA
As in part 2.1
Stripe
Legal entity
Stripe; the entity in Qubites' Stripe account agreement is being confirmed
Purpose
Payments, invoices, the Customer Portal, VAT calculation and VAT ID checks (Stripe Tax); with the dashboard's own checkout, Stripe.js on that page of app.dpphost.eu, with Stripe's own fraud-prevention cookies and device signals. Not live: billing is not switched on yet
Personal data
Organisation name, billing email, billing address, VAT ID, payment method details (held by Stripe; Qubites never sees card or account numbers)
Location
Being confirmed
Transfer mechanism
DPF; SCCs in Stripe's DPA; transfers go to Stripe, LLC (USA)
DPA
https://stripe.com/legal/dpa (service providers: https://stripe.com/legal/service-providers). Stripe's DPA (read 2 Oct 2026) makes Stripe a processor for the payment services and an independent controller for fraud prevention, its legal duties (such as anti-money laundering), product improvement and platform upkeep; the privacy notice says so
Scaleway
Legal entity
As in part 2.2
Purpose
Off-site copies of Qubites' own records in the database. Switched off
Personal data
All personal data in the database's public schema, except sign-in data and secrets
Location
Paris, France
Transfer mechanism
As in part 2.2
DPA
As in part 2.2
Sentry
Legal entity
As in part 2.2
Purpose
Error reports from the dashboard. Switched off
Personal data
Page address; no user details
Location
EU ingest
Transfer mechanism
As in part 2.2
DPA
As in part 2.2
4. Recipients that are not sub-processors
4.1 These receive data from DPP Host but do not process it for Qubites:
EU VIES (European Commission and national tax authorities): receives the VAT number an organisation enters for business verification. Public register lookup.
Danish Business Authority (Erhvervsstyrelsen), CVR: would receive a Danish CVR number for business verification, through distribution.virk.dk, once Qubites has access to it. Public register lookup. Not in use yet: Danish numbers are checked in VIES, and staff look the CVR up by hand.
Google, Apple and Microsoft (sign-in providers, switched on since 1 Oct 2026): when a member chooses "Sign in with Google", "Sign in with Apple" or "Sign in with Microsoft", the provider authenticates the person under its own privacy terms and, at the person's request, passes the person's user id at the provider, verified email address and name to Supabase Auth, where they are stored as an identity of the account. The provider learns that the person signs in to DPP Host. Each provider is an independent controller of the sign-in itself, not a processor for Qubites. Apple's "Hide My Email" relay addresses are Apple's service; mail to them is relayed by Apple.
YouTube (Google) and Vimeo: a Brand may show a video from either on its passport page. The page shows a poster from assets.dpphost.eu and loads the player (youtube-nocookie.com, or player.vimeo.com with dnt=1) only after the visitor presses play; the provider then receives the visitor's IP address and browser data under its own terms. Chosen by the Brand, not engaged by Qubites.
Providers of AI apps a member connects (MCP clients such as an AI assistant): receive the passport, product and draft data the app reads under the member's grant, never member, owner, key, audit or billing data. Chosen by the member, not engaged by Qubites.
GS1 registers (Verified by GS1): Qubites staff look up a GTIN or company prefix by hand to decide a GTIN claim. No personal data is sent.
OpenTimestamps calendars (alice.btc.calendar.opentimestamps.org, bob.btc.calendar.opentimestamps.org, finney.calendar.eternitywall.com): receive one 32-byte hash a day. No personal data. The service that anchors them also looks up the Bitcoin transactions of those proofs at Blockstream (blockstream.info) and mempool.space. No personal data.
GitHub, Inc.: hosts the source code and runs automated tests. Tests use no production data. The test report sent back to DPP Host holds only run details.
WordPress.org: distributes the WooCommerce plugin. It receives no Processor Data.
The Brand's own webhook endpoints, shops and offer partners: the Brand's own systems or the Brand's partners, not engaged by Qubites.
Public authorities: the police (Rigspolitiet, NC3) under DSA Art. 18, and courts or authorities where the law requires it.
4.2 Passport scan statistics are kept by Cloudflare Analytics Engine with the product path (no serial number), language and country only: no IP address, browser details or cookie. They are not personal data.
5. How changes are announced
5.1 Sub-processors for Processor Data. Qubites tells Brands about an intended addition or replacement of a sub-processor at least 30 days before the new sub-processor processes Processor Data. The notice goes by email to the owners and admins of each Brand, each in their own language, and on this page, where the new sub-processor's row shows the day it starts. It names the sub-processor, its location, what it does and the transfer mechanism, if any (DPA clause 7.3).
5.2 Objection. A Brand may object in writing to privacy@dpphost.eu within the notice period, on reasonable data protection grounds. The parties then try in good faith to find a solution. If they find none before the change takes effect, the Brand may end its use of owner services, and of any other affected service, from that date without penalty (DPA clause 7.4).
5.3 Urgent replacement. If Qubites must replace a sub-processor urgently to keep the service secure or available, it gives notice as early as possible, and always before the new sub-processor processes Processor Data. Where the emergency allows, the notice is at least 5 working days. A Brand that objects and finds no solution may end its use of owner services at once, without penalty (DPA clause 7.5).
5.4 Built but off, or planned. The providers in parts 2.2 and 2.3 are not authorised until Qubites has given notice under clause 5.1 (DPA clause 7.6).
5.5 Providers used as controller. Qubites updates part 3 and its privacy notice at dpphost.eu/privacy before a new provider processes personal data for Qubites' own purposes.
5.6 Change log. Every change to this page is dated in part 6.
5.7 Notices sent. Qubites keeps a record of each notice: what changed, the day it applies from, when it was sent and to how many people. It keeps no list of the addresses in that record.
5.8 Anthropic in place of Amazon Web Services. The notice of 12 October 2026 named Amazon Web Services (Amazon Bedrock) for New passport's reading from 12 November 2026. Amazon Web Services has not processed and will not process Processor Data. Anthropic (Claude API) takes its place, for New passport's reading and for the GS1 documents added to GTIN claims (part 2.2), under a notice of its own: it goes to the owners and admins of every Brand on the day Qubites sends it, says that it replaces Amazon Web Services, and names a start day at least 30 days later, which Anthropic's row in part 2.2 then shows. Anthropic processes no Brand's data before that day.
6. Change log
Date
Change
12 Oct 2026
First version. Amazon Web Services (Amazon Bedrock) listed in part 2.2 for New passport's reading, in the EU; not yet announced.
12 Oct 2026
Notice sent to the owners and admins of every Brand: Amazon Web Services (Amazon Bedrock) starts on 12 November 2026.
18 Oct 2026
Part 3: Resend no longer sends trial emails, as DPP Host no longer offers a trial. No provider added or removed.
18 Oct 2026
Part 2.2: Anthropic (Claude API) replaces Amazon Web Services (Amazon Bedrock) for New passport's reading. The reading now runs outside the EU. Not yet announced.
20 Oct 2026
Part 2.2: Anthropic (Claude API) also reads the GS1 licence certificate or membership invoice an admin adds to a GTIN claim. Part 5.8: the notice for Anthropic is prepared. It applies from at least 30 days after the day Qubites sends it, and names Anthropic in place of Amazon Web Services, which has not processed and will not process Processor Data. Not yet sent.
29 Oct 2026
Part 2.1: Microsoft 365's contracting entity (Microsoft Ireland Operations Limited, bought through GoDaddy) and the region of the mailbox (the European Union). No provider added or removed.