Subprocessor Disclosure
Last reviewed: March 2026
TabWall uses a small number of third-party service providers ("subprocessors") to operate the platform. This page lists all subprocessors, explains what they do, and tells you where your data is stored.
We keep this list up to date. If we plan to add or change a subprocessor, we will notify you at least 30 days in advance, as described in our Data Processing Agreement.
Table of Contents
Our Subprocessors
| Name | Purpose | Data Processed | Data Residency |
|---|---|---|---|
| Hetzner Cloud | Infrastructure hosting (K3s cluster) | All platform data | Germany, EU |
| Stripe | Payment processing | Organisation billing data (name, email, payment method) | EU (Ireland) |
| Google Sheets API | Optional consumption sync | Event consumption records (member name, beverage, timestamp) | EU/US (with Standard Contractual Clauses) |
| ML Inference Service | Face recognition | Face embeddings (biometric data) | EU |
Hetzner Cloud
Hetzner provides the cloud servers that run TabWall. All platform data — including member information, event records, and biometric data — is stored on Hetzner servers located in Germany within the European Union.
Stripe
Stripe handles payment processing for organisation subscriptions. When an organisation subscribes to a paid plan, Stripe processes the billing information (name, email address, and payment method). Stripe stores this data in the EU (Ireland). TabWall does not store credit card numbers or bank details directly.
Google Sheets API
Some organisations choose to sync their event consumption data to Google Sheets for reporting purposes. When this feature is enabled, member names, beverages, and timestamps are sent to the Google Sheets API. Google may process this data in the EU or US, with Standard Contractual Clauses in place for any transfers outside the EU.
ML Inference Service
TabWall offers optional face recognition to allow hands-free check-in at events. The ML Inference Service processes face embeddings (mathematical representations of faces) to identify members. This service runs within the EU. Face embeddings are biometric data and receive extra protection under GDPR. Members must give explicit consent before their face data is processed. See our Privacy Policy for details on how biometric data is handled.
Updates to This List
We review this list regularly and update it whenever our subprocessors change. Under our Data Processing Agreement, we commit to:
- Notifying you at least 30 days before adding or replacing a subprocessor
- Giving you the opportunity to object to any change
- Allowing you to terminate the agreement if your objection cannot be resolved
Contact
If you have questions about our subprocessors or how your data is processed, please contact us:
Email: privacy@tabwall.de
Related Documents
- Privacy Policy — How we collect, use, and protect your personal data
- Terms of Service — The rules for using TabWall
- Data Processing Agreement — The formal agreement between your organisation and TabWall for data processing
- Cookie Notice — Information about cookies used by TabWall
This subprocessor disclosure was last reviewed in March 2026.