Skip to main content
OCTOVO
Download

Four service providers process on our behalf: Microsoft, Hetzner, Stripe and Mailgun. Listed separately is where your device establishes connections itself — no one there acts on our behalf.

This English version is provided for information only. The German version is the authoritative one; in case of any discrepancy, the German version prevails.

Sub-processors (Unterauftragsverarbeiter)

As of: 25 September 2026 · Changes are announced at least 30 days in advance.

Working on our behalf

These four process data on behalf of TCB GmbH. The consent in § 6 of the data processing agreement relates to them — and only to them.

  • Microsoft Ireland Operations Limited (Azure AI Foundry)
    For what
    Operation of the approved OpenAI language models via Azure AI Foundry (default: GPT-5.6 Terra, fallback: GPT-5.6 Luna) — the model manufacturer is OpenAI, the processor is exclusively Microsoft. According to Microsoft’s own documentation, OpenAI itself has no access to the transmitted requests.
    Where
    The Azure resource is located in the EU (Sweden Central); however, according to Microsoft’s own documentation the chosen “Global Standard” deployment type processes in any Azure region worldwide — a restriction to the EU cannot therefore be substantiated.
    Basis
    Data processing agreement (Microsoft Products and Services Data Protection Addendum) and standard contractual clauses
  • Hetzner Online GmbH
    For what
    Hosting of server and website
    Where
    Germany
    Basis
    Data processing agreement
  • Stripe Payments Europe, Ltd.
    For what
    Payment processing, invoices, tax calculation
    Where
    Ireland / USA
    Basis
    Acting on its own responsibility, supplemented by standard contractual clauses
  • Mailgun Technologies (EU region)
    For what
    Sending account and system emails
    Where
    European Union
    Basis
    Data processing agreement

Not on our behalf: where your device connects on its own

These parties are listed here for completeness, but they are not sub-processors: there is no contractual relationship, they do not act on our instructions, and the connection arises on your device without us learning of it. Your IP address is visible to the other side, as with any request from a browser. Details are set out in section 8 of the privacy policy .

  • Open-Meteo
    For what
    Weather forecast for the “Today” board and the “wetter” tool
    Where
    Germany and Switzerland
    How it stands legally
    No contractual relationship: what is transmitted is solely the place name you entered yourself, or its coordinates — no account, no key, no identifier. The request runs directly from your device, your IP address is visible to Open-Meteo; at most four times per hour. Without a place entered, no request takes place.
  • The provider of your mailbox
    For what
    Fetching and sending your mail, and finding the right settings during setup
    Where
    wherever your provider is located
    How it stands legally
    No contractual relationship between us and it: your device talks directly to the mail server, the credentials sit in your operating system’s keychain. Your provider’s terms apply.
  • The platforms of your connected channels
    For what
    Cloud storage, Facebook pages, Instagram business accounts, LinkedIn and the other networks
    Where
    depending on the platform
    How it stands legally
    No contractual relationship between us and them: you connect your own account, your device talks directly to the platform. Their terms and privacy notices apply.
  • Tavily (AlphaAI Technologies Inc.)
    For what
    Web search — only if you have stored your own access under Settings → “Web search” and chosen Tavily. What is transmitted is your search query in plain text and your key.
    Where
    New York, USA
    How it stands legally
    No contractual relationship between us and it: you open the account yourself, the request runs from your device, your IP address is visible to Tavily. Third country without an adequacy decision; according to its own privacy policy Tavily bases transfers on standard contractual clauses and is not certified under the EU-US Data Privacy Framework (checked on 22 August 2026). Without stored access, no request takes place.
  • Brave Search (Brave Software, Inc.)
    For what
    Web search — only if you have stored your own access under Settings → “Web search” and chosen Brave. What is transmitted is your search query in plain text and your key.
    Where
    San Francisco, USA
    How it stands legally
    No contractual relationship between us and it: you open the account yourself, the request runs from your device, your IP address is visible to Brave. Third country without an adequacy decision; under its own data processing agreement Brave bases transfers on standard contractual clauses and is not certified under the EU-US Data Privacy Framework (checked on 22 August 2026). A representative in the Union under Art. 27 DSGVO has been designated. Without stored access, no request takes place.
  • Google News (Google Ireland Limited)
    For what
    News feed (RSS) for questions about news and for a “News” board tile you created yourself. What is transmitted is your search query in plain text as part of the address.
    Where
    Ireland (Dublin)
    How it stands legally
    No contractual relationship between us and it, no account and no key: the feed is public, the request runs from your device, your IP address is visible to Google. This route is the only one of the three that can run without any action on your part — it needs no stored access and is used when you ask about news or have created a “News” tile. According to Google’s privacy policy, the controller for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4.
  • GitHub (GitHub, Inc. / GitHub B.V.)
    For what
    Looking at the issues, pull requests and workflow runs of a repository when you ask for it. What is transmitted is the repository name as part of the address — and, if you have stored your own GitHub access token under Settings, that token. OCTOVO only reads there; nothing is written.
    Where
    San Francisco, USA / Amsterdam, Netherlands
    How it stands legally
    No contractual relationship between us and it: the request runs from your device, your IP address is visible to GitHub. Public repositories need no token — so this route runs without any setup, but only when you ask for it; nothing happens here on its own. According to GitHub’s own privacy statement the controller is GitHub, Inc. (88 Colin P. Kelly Jr. St., San Francisco) or GitHub B.V. (Prins Bernhardplein 200, 1097 JB Amsterdam). GitHub is certified under the EU-U.S. Data Privacy Framework (entry “GitHub”, Non-HR Data, checked on 23 August 2026) and additionally bases transfers on the Commission’s standard contractual clauses (Implementing Decision 2021/914). No separate representative under Art. 27 GDPR is designated; GitHub B.V. constitutes an establishment in the Union.
  • Pages OCTOVO looks up for you
    For what
    Research on the web when you ask it to — and opening the best hits of a search
    Where
    wherever the respective page is located
    How it stands legally
    No contractual relationship: the request goes out from your device and looks to the other side like a visit with your browser. The operator of the page sees your IP address and the address requested.

What is deliberately missing here

No analytics service, no advertising network, no error-collection service, no third-party fonts, no consent tool. We do not use them — which is why they do not appear here.

And what never arises in the first place

Your emails, files, contacts and your memory are not transmitted to any of these service providers and reside exclusively on your device. What is transmitted is only the respective excerpt OCTOVO needs for a single thinking request.