Privacy

Subprocessors

The companies that host and deliver Rykon Mail on our behalf, what each does, what data it receives and where.

Version
2.1
Effective
30 October 2026
Last updated
30 October 2026

  1. 1.Current subprocessors

    • Company

      Hetzner Online GmbH

      What it does
      Data centre hosting: the servers, Kubernetes cluster, databases and mail storage that run Rykon Mail
      Data
      All service data, including mailboxes, account data, audiences, campaign and delivery records
      Location
      Germany (Nuremberg and Falkenstein). A database quorum server that holds no customer data runs in Helsinki, Finland
      Transfer basis
      Within the EEA

    • Company

      Amazon Web Services, Inc.

      What it does
      Sending outbound mail (Amazon SES), and reporting delivery, bounces, complaints, opens and clicks (Amazon SNS, SQS and CloudWatch)
      Data
      Outbound messages and their recipients, delivery and engagement events, per-account sending metrics
      Location
      United States (US East, N. Virginia)
      Transfer basis
      Standard Contractual Clauses

    • Company

      Cloudflare, Inc.

      What it does
      Storage of encrypted backups (R2), and authoritative DNS for our own domains
      Data
      Backup archives encrypted before they leave our servers; DNS records for our domains, which hold no personal data
      Location
      Cloudflare R2 with a Western Europe location hint; DNS served worldwide
      Transfer basis
      Standard Contractual Clauses

    • Company

      Anthropic, PBC

      What it does
      AI writing help and drafted agent replies, only when a customer uses those features
      Data
      The brief, draft or block being written and the account name; for drafted agent replies, the incoming message (sender, subject and up to 8,000 characters of text). Never contact lists
      Location
      United States
      Transfer basis
      Standard Contractual Clauses

    • Company

      OpenAI, L.L.C.

      What it does
      Fallback for the same AI features, used only when Anthropic is unavailable
      Data
      The same as Anthropic, for a request that falls back
      Location
      United States
      Transfer basis
      Standard Contractual Clauses

    • Company

      Stripe, Inc.

      What it does
      Payment for paid plans: card processing, invoices and receipts
      Data
      Billing contact and organisation, payment card details (held by Stripe, never by us), charges
      Location
      United States
      Transfer basis
      Standard Contractual Clauses

  2. 2.Run by us, not by a subprocessor

    Sign-in (our identity service), webmail, the mail server, the AI gateway and model router, and our monitoring run on our own servers at Hetzner in Germany, operated by our staff. No other company handles the data they hold.

    If you choose to sign in with Google, Google is the provider of your own Google account, not our subprocessor: at your request it tells our identity service who you are, and it processes no data for us. The privacy policy says what it shares and what we keep.

  3. 3.Changes and objections

    We give at least 30 days’ notice here and by email before adding or replacing a subprocessor. To object, or to ask about any of them, write to privacy@rykonmail.com. The data processing addendum sets out what happens if we cannot address an objection.

Change log

  1. Version 2.1
    30 October 2026

    Said where Google stands when you choose Sign in with Google: your own account provider, not a subprocessor.

  2. Version 2.0
    30 October 2026

    Added the transfer basis for each. Listed OpenAI separately as a fallback only, and Stripe. Gave the Hetzner and R2 locations. Added the services we run ourselves.

  3. Version 1.0
    29 October 2026

    First published.