List of Sub-Processors
ONFYRE
Version 1.2 – Last updated: August 2026
This list names the sub-processors that we, appnormal GmbH, engage to provide the ONFYRE platform. It is maintained and kept up to date in accordance with § 12 of our Terms and Conditions and our Privacy Policy.
We will inform users of material changes (addition or replacement of sub-processors) in an appropriate manner. Users acting as controllers within the meaning of the GDPR may object to a change on important data protection grounds within 30 days.
| Provider | Purpose | Region | Transfer safeguard | DPA |
|---|---|---|---|---|
| Vercel Inc. 340 S Lemon Ave #4133, Walnut, CA 91789, USA | Platform hosting, delivery, CDN | EU (Frankfurt) / USA | EU-U.S. DPF, SCC (Art. 46 GDPR) | vercel.com/legal/dpa |
| Amazon Web Services EMEA SARL 38 Avenue John F. Kennedy, L-1855 Luxemburg | Email delivery (Amazon SES), cloud infrastructure | EU (Frankfurt) | EU-U.S. DPF, SCC (Art. 46 GDPR) | aws.amazon.com/compliance/gdpr-center |
| Mux, Inc. 88 Stevenson Street, San Francisco, CA 94105, USA | Video processing, encoding and streaming | EU / USA | EU-U.S. DPF, SCC (Art. 46 GDPR) | mux.com/dpa |
| Upstash, Inc. USA | Serverless database / caching (Redis), rate limiting | EU (Frankfurt) / USA | SCC (Art. 46 GDPR) | upstash.com/trust/dpa.pdf |
| Neon Inc. San Francisco, CA, USA | Serverless database (PostgreSQL) | EU (Frankfurt) / USA | SCC (Art. 46 GDPR) | neon.tech/dpa |
| PostHog Inc. 2261 Market Street #4008, San Francisco, CA 94114, USA | Product analytics in the logged-in area (dashboard) | EU (Frankfurt) | EU-U.S. DPF, SCC (Art. 46 GDPR) | posthog.com/dpa |
| Stripe Payments Europe, Ltd. 1 Grand Canal Street Lower, Dublin, D02 H210, Irland | Payment processing (Pro plan, shop) | EU / USA | EU-U.S. DPF, SCC (Art. 46 GDPR) | stripe.com/legal/dpa |
Third-Party Integrations (user-activated)
The following services are not sub-processors. They are only activated when a user uses the corresponding feature or embed on their ONFYRE page. In doing so, data may be transmitted directly to the respective provider, who is independently responsible for it. The privacy policy of the respective provider applies.
| Provider | Purpose / Feature |
|---|---|
| Google / YouTube | Google login (OAuth), YouTube data/embeds, YouTube Music |
| Meta / Instagram | Instagram login (OAuth) + Graph API |
| TikTok | TikTok login (OAuth), embeds |
| Apple | Sign in with Apple, Apple Music API, iTunes Lookup |
| Spotify | API, oEmbed, public embeds |
| TIDAL | Music embeds / linking |
| Deezer | Music embeds / linking |
| SoundCloud | Audio embeds / linking |
| Twitch | Stream embeds / linking |
| Kick | Stream embeds / linking |
| Ticketmaster | Event / ticket linking |
Note: The status of this list is indicated by the version information above. For questions, contact support@onfyre.atlassian.net.