Sub-processors
Last updated: 29 October 2026
Damper is provided by Studio 404 d.o.o., Gradišče 15C, 1360 Vrhnika, Slovenia, EU, company registration no. 6835228000, VAT ID SI42531357 ("Damper", "we", "us"), contact: [email protected].
This page lists every service outside our own application that receives personal data from Damper. We will update it at least 30 days before adding or replacing a sub-processor that processes Customer Data, and email account owners when we do (see section 5 of the DPA). To ask about changes, write to [email protected].
1. Sub-processors for Customer Data
These process the data you and your users put into Damper: feedback, visitors, subscribers, pages, status pages and error reports.
| Sub-processor | Purpose | Personal data | Location and transfer mechanism |
|---|---|---|---|
| Railway Corporation (United States) | Hosting of the API and background workers, the database, the cache, file storage and the daily database backups | All data stored by the application: account data and Customer Data | Netherlands (Railway EU region). Data is stored in the EU; Standard Contractual Clauses for any access from outside the EEA |
| Amazon Web Services EMEA SARL (Luxembourg); Amazon Simple Email Service | Sending email: notifications to your team, invitations, and changelog and status updates to your subscribers | Recipient email address and name, and the content of the email | Germany (eu-central-1, Frankfurt). Data is processed in the EU; EU-US Data Privacy Framework and Standard Contractual Clauses for any access by the US parent |
| OpenAI (OpenAI Ireland Ltd; OpenAI, L.L.C., United States) | AI features: feedback summaries, error triage, page summaries, meeting action items and roadmap suggestions (section 4 of the DPA) | The text and context sent for each feature: feedback text with the visitor's plan or tier, page address, browser details and captured technical context; error log excerpts; page content; task titles and descriptions | United States. Standard Contractual Clauses. Not used to train models |
| Anthropic (Anthropic Ireland, Limited; Anthropic, PBC, United States) | The same AI features, when OpenAI is unavailable | As for OpenAI | United States. Standard Contractual Clauses. Not used to train models |
| Functional Software, Inc. (Sentry) (United States) | Error monitoring of the API and the dashboard | Technical error reports: the page or API path, browser and device details, the user ID of the signed-in user, and any personal data that appears in an error message. No request bodies, headers, cookies or query values | United States. EU-US Data Privacy Framework; Standard Contractual Clauses |
| Twilio (Twilio Ireland Limited; Twilio Inc., United States) | Phone-call alerts about status incidents | The verified phone number of the team members who turn on call alerts, and the spoken alert: project, check and incident names | United States. EU-US Data Privacy Framework; Standard Contractual Clauses |
| GitHub, Inc. (United States) | Running the daily database backup job, which copies the backup from the database to our backup storage in the EU | The database backup, held only temporarily on the job's machine while the job runs and deleted when it ends | United States. EU-US Data Privacy Framework; Standard Contractual Clauses |
Integrations you connect (such as Slack or X), webhooks you configure and the addresses you monitor with status checks receive data on your instructions. They are your own providers, not our sub-processors.
2. Services for account, billing and support data
These process data about you as our customer (not the content you put into Damper), as described in the Privacy Policy.
| Service | Purpose | Personal data | Location and transfer mechanism |
|---|---|---|---|
| Stripe Payments Europe, Ltd. (Ireland) | Card payments for paid plans | Account name, billing email address, your account ID, the amount and currency of each payment, card details (entered directly with Stripe; we never see them) | EU and United States. EU-US Data Privacy Framework; Standard Contractual Clauses |
| PostHog, Inc. (United States); PostHog EU Cloud | Product analytics: page views on the website and in the app, and account milestones sent from our servers. Reached through our own address usedamper.com/ingest | Without analytics consent: a daily-changing identifier that PostHog computes from your IP address and browser details (the IP address is used for this and not stored). With consent: a random identifier kept in your browser, after sign-in your user ID and account ID, and an approximate location (country, region, city and time zone) looked up from your IP address, which is not stored. Always: page addresses without query strings except campaign tags, the referring domain, browser language and basic browser and device details; sign-up source (referring domain, campaign tags with analytics consent, whether an ad click identifier was present), first agent connection and payments (plan, amount, currency). Never names, email addresses or Customer Data | Germany (EU Cloud, Frankfurt). Data is stored in the EU; Standard Contractual Clauses for any access from outside the EEA |
| Twilio (Twilio Ireland Limited; Twilio Inc., United States); Twilio Verify | Verifying your phone number by text message | Your phone number and the verification code | United States. EU-US Data Privacy Framework; Standard Contractual Clauses |
| HAL (chatwithhal.com), our own support chat product, operated by Studio 404 d.o.o. (Slovenia) | The support chat in the app | Your name, email address, user ID and account ID, and the messages and attachments you send in the chat | EU (HAL's own providers: Railway, Cloudflare, PostHog EU). HAL uses AI models from Anthropic and xAI to answer and suggest support replies, which may process chat messages outside the EU; Standard Contractual Clauses for HAL's AI providers |
| Cloudflare, Inc. (United States) | Hosting of the website (usedamper.com) and the dashboard app (app.usedamper.com) | Web traffic: IP address and browser details. The API does not run on Cloudflare | Global network. EU-US Data Privacy Framework; Standard Contractual Clauses |
Error reports from the dashboard and the API go to Sentry, and email from us goes through Amazon SES, as listed in section 1.