Subprocessors
Green Story Platform & API Services
This page lists the subprocessors authorised to process Personal Data on behalf of Green Story Europe B.V. under our Data Processing Agreement. It constitutes the Subprocessor Page referenced in Section 5 and Annex III of the DPA.
Subscribe to updates. Green Story provides at least 30 days’ notice before a new subprocessor processes Personal Data, by updating this page. To also receive updates by email, subscribe by sending a message to [email protected] with the subject “Subscribe to subprocessor updates”.
Authorised subprocessors
| Subprocessor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| SimpliZero Sustainable Solutions Private Limited (Green Story affiliate) | Support, operations and engineering personnel (remote access) | India | Intra-group agreement incorporating SCCs |
| Hetzner Online GmbH | Cloud infrastructure hosting (platform, databases) | Germany / Finland (EU) | EU processing |
| Redis Ltd. | Managed in-memory data store (caching and session data) | EU region | EU processing; SCCs for any support access from outside the EEA |
| Cloudflare, Inc. | CDN, WAF, DNS, DDoS mitigation | USA (global network) | EU–US DPF; SCCs |
| Amazon Web Services | Object storage, email delivery, queuing, key management — all hosted in EU regions. Sole exception: user authentication (Amazon Cognito), hosted in a US region | EU regions; USA (Cognito only) | EU–US DPF; SCCs |
| OpenAI, L.L.C. | AI-assisted features (API data not used for model training) | USA | EU–US DPF; SCCs |
| Zoho Corporation | Customer support helpdesk (support communications, contact data) | USA / EU data centres | SCCs |
| WhatsApp Ireland Limited (Meta) | Messaging channel for customer-submitted information (e.g. product data, specification sheets, bills of materials and related documents, which may contain business contact details) | Ireland (EU); USA | EU–US DPF; SCCs |
| Mixpanel, Inc. | Product analytics and session analytics for platform usage | USA | EU–US DPF; SCCs |
| Chargebee, Inc. | Subscription billing (billing contact data) | USA | EU–US DPF; SCCs |
| Stripe, Inc. | Payment processing (billing contact data) | USA | EU–US DPF; SCCs |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Payment processing (billing and payment contact data) | Luxembourg (EU); USA | EU processing; SCCs |
| Xero Limited | Accounting and invoicing (customer name, address, billing contact data) | New Zealand; USA | Adequacy decision (New Zealand); SCCs |
“SCCs” means the EU standard contractual clauses (Decision (EU) 2021/914). “EU–US DPF” means the EU–US Data Privacy Framework.
Objections
If you reasonably object to a new subprocessor on data protection grounds, notify us within the 30-day notice period per Section 5 of the DPA at [email protected].
Change log
| Date | Change |
|---|---|
| 14 July 2026 | Initial publication at greenstory.io/legal/subprocessors. List matches DPA v2.0, Annex III (May 2026). |