Your data
Subprocessors
Every company that touches your data, what it does, and what it can see. It is a short list and all of them are European.
Last updated 8 September 2026
A subprocessor is a company I use to run Kromdraw that could, in the course of doing its job, come into contact with something you put in. There are five. Naming them is the only way you can check the claim on the front page rather than take my word for it.
| Company | Country | What it does | What it can see |
|---|---|---|---|
| netcup | Germany | Rents the server the application and its database run on. | Everything, in principle, since the database sits on a disk they own. They have no reason or means to look at it in the ordinary course of things, but a hosting company is always on this list. |
| Bunny | Slovenia | Sits in front of the site and serves its files. Also holds the images you upload. | The pictures you put on a canvas, as files, and the requests your browser makes. |
| Scaleway | France | Holds the continuous database backup, in its Amsterdam region. | Nothing readable. The backup is encrypted before it leaves the server, with a key Scaleway does not hold, so what it stores is ciphertext and how much of it there is. |
| Lettermint | Netherlands | Delivers the email the application sends. | Your email address, and the contents of those messages. There are three of them: a password reset link, the notice that your password was changed, and the link that confirms an email address. |
| Creem | Estonia | Takes the payment. Creem is the merchant of record, so it is the legal seller and the name on your card statement. | The billing contact's name and email address, the number of members, and the card details you give it. Kromdraw never sees a card number. Nothing you draw reaches it. |
None of them is American
All five are European companies, and there is nothing above Ronkatil B.V. but Ronkatil B.V. Creem is Armitage Labs OÜ, registered in Tallinn, Estonia, and its terms are governed by Estonian law. So the line on the front page about no American services in between has no exception underneath it.
One of the five has a parent: netcup has belonged to the Anexia group since 2016, and Anexia is Austrian, in Klagenfurt. That is a European company owned by a European company, so the sentence above still holds. "No parent" is a claim about Ronkatil B.V. rather than about every company it buys from.
What is not on the list
No analytics provider, no error-tracking service, no advertising network, no customer-support tool, no font CDN, and no AI or model provider, because there are no AI features in Kromdraw. The analytics Kromdraw does have is its own, on its own server, so there is no company to name for it. Any of these would appear here before it appeared anywhere else.
Changes
The date at the top is the last time this page changed. If a company is added or removed, I update it here first and email organisation owners at least 30 days before the change takes effect, unless a legal or urgent security reason requires it sooner.