Subprocessors
Last changed: August 16, 2026
MusicFlow engages a small number of other parties to deliver the service. This page is the current list and forms Annex A to the processor agreement.
Always engaged
Hetzner Online GmbH
Inside the EEA- Purpose
- Hosting, file storage and encrypted off-site backups
- Data involved
- All data in MusicFlow: accounts, groups, events and uploaded files
- Location
- Germany (Falkenstein, Nuremberg)
AhaSend B.V. (KvK 99533111)
Inside the EEA- Purpose
- Sending email: password resets, sign-in codes, invitations and alerts
- Data involved
- The recipient's name and email address, and the message content
- Location
- Netherlands (Amsterdam)
Only when you enable them
Apple Inc.
Outside the EEAOnly with push notifications
- Purpose
- Delivering push notifications to Safari, and on iOS regardless of browser
- Data involved
- Your browser's technical delivery address. The message content is encrypted and not readable by the push service.
- Location
- United States
Google LLC
Outside the EEAOnly with push notifications
- Purpose
- Delivering push notifications to Chrome on desktop and Android
- Data involved
- Your browser's technical delivery address. The message content is encrypted and not readable by the push service.
- Location
- United States
Mozilla Corporation
Outside the EEAOnly with push notifications
- Purpose
- Delivering push notifications to Firefox on desktop and Android
- Data involved
- Your browser's technical delivery address. The message content is encrypted and not readable by the push service.
- Location
- United States
Microsoft Corporation
Outside the EEAOnly with push notifications
- Purpose
- Delivering push notifications to Microsoft Edge on desktop
- Data involved
- Your browser's technical delivery address. The message content is encrypted and not readable by the push service.
- Location
- United States
On iOS, push always uses Apple's infrastructure regardless of which browser you use — Apple restricts web push to Safari added to your home screen. On desktop and Android, this list names the browsers we've verified; we haven't audited every possible browser, and most unlisted Chromium-based ones default to Google's infrastructure unless the maker has swapped it out (as Microsoft has for Edge).
If we add or replace a subprocessor, we announce it at least 30 days in advance on this page and by email to your organisation's contact address. You may object on reasoned grounds.