GDPR & DPA
DPA, sub-processor list, lawful basis per processing activity, DPO contact.
CleverRouter (operated by Clevermation GmbH) is your processor (Art. 28 DSGVO). You stay the controller. By default your data is processed inside the EU. If you opt into the US-headquartered providers (AWS Bedrock, Microsoft Azure), inference runs strictly within the EU/EFTA data boundary — the EU plus the EFTA states — and never outside it. See the third-country-transfer note below.
At a glance
| Role | Processor (Art. 28 DSGVO) |
| DPA | Click-through at workspace setup, downloadable as PDF |
| DPO | Dr. Lars Hoffmann, dpo@clevermation.com |
| DSGVO rights | privacy@clevermation.com, SLA 30 days |
The DPA
The data-processing agreement is signed click-through at workspace
setup and is available as a PDF at /app/compliance/dpa any time.
You'll want to download a copy for your own records.
Lawful basis per processing activity
| Processing | Legal basis | Retention |
|---|---|---|
| Inference on prompts | Art. 28 DSGVO (data processing) | 0s (ZDR) |
| Account data | Art. 6 (1) b (contract) | Until account deletion |
| Billing data | Art. 6 (1) c (legal obligation) | 10 years (HGB §257) |
| Audit logs | Art. 6 (1) f (legitimate interest) | 365 days |
Third-country transfer: no default transfer. Optionally
activatable US-headquartered providers operate on EU infrastructure
under their EU DPA + SCCs: Anthropic via Bedrock-EU (AWS-EU-DPA), and
Microsoft Azure AI Foundry inside the EU Data Boundary (EU/EFTA).
The EU Data Boundary covers the EU plus EFTA states Norway and
Switzerland (both hold GDPR adequacy). Both are switchable in the
dashboard at /app/compliance/providers.
Data-subject rights (Art. 15–22 DSGVO)
Send requests to privacy@clevermation.com. SLA 30 days.
Sub-processors
Contractually held to the same TOMs as our own.
| Provider | Region | Function | Status |
|---|---|---|---|
| OVHcloud SAS | Paris (FR) | Infrastructure, storage | active |
| Scaleway SAS | Paris (FR) | LLM inference (Mistral, Llama) | active |
| Mistral AI SAS | Paris (FR) | LLM inference (Mistral direct) | active |
| Tensorix GmbH | Dublin (IE) / Helsinki (FI) | LLM inference (Llama, Mixtral) | active |
| AWS EMEA | Frankfurt (DE) | Bedrock-EU (opt-in) | active |
| Microsoft | EU Data Boundary — Sweden (EU/EFTA) | Azure AI Foundry — GPT & Foundry models (opt-in) | built, dormant |
| Stripe Payments Europe | Dublin (IE) | Payments | active |
| Plausible Insights OÜ | Tallinn (EE) | Web analytics (cookieless) | active |
| Postmark (ActiveCampaign) | Frankfurt (DE) | Transactional email | active |
| Cohere Europe BV | NL / IE | Embeddings | Q3 2026 |
| Voyage AI (EU replication) | EU | Embeddings | Q3 2026 |
New sub-processors are announced at least 30 days before go-live — via email, in-app banner and RSS feed.
Right to object (Art. 28 (2) DSGVO)
Individual providers can be deactivated via the allowlist at
/app/compliance/providers. If you object to a planned new
sub-processor, write to the DPO before the 30-day window expires.
DPO
Dr. Lars Hoffmann, dpo@clevermation.com. Mail-only, no phone — German DPA guidance recommends written form.
Related
- Zero data retention — what is and isn't logged.
- EU AI Act — model-level transparency.
- Why EU-native — the architectural invariants behind the policy.