The following third-party service providers process personal data on behalf of Mitlus. This list is maintained in accordance with GDPR Article 28.
| Sub-Processor | Purpose | Data Shared | Jurisdiction | DPA Status |
|---|---|---|---|---|
| Google (OAuth) | User authentication via Google Sign-In | Email, name, profile image, OAuth tokens | EU/US | Google Cloud DPA |
| Stripe | Payment processing and subscription billing | Name, email, payment method, billing address, subscription details | US (EU data handling) | Stripe DPA |
| Anthropic | AI model provider (Claude) for chat and analysis features | Chat messages, startup context data sent in prompts | US | Anthropic DPA / Terms of Service |
| OpenAI | AI model provider (GPT) — optional, user-selectable | Chat messages, startup context data sent in prompts | US | OpenAI DPA |
| Google AI (Gemini) | AI model provider (Gemini) — optional, user-selectable | Chat messages, startup context data sent in prompts | US | Google Cloud DPA |
| OpenRouter | AI model routing — Mitlus One (Gemini 3.8 Flash) and Mitlus Max (Kimi K3) | Chat messages, startup context data sent in prompts | US | OpenRouter Terms of Service |
| Tavily | Web search API for research features | Search queries derived from user prompts | US | Tavily Terms of Service |
| Hetzner Online GmbH | Application hosting, server infrastructure, and database hosting | All application data in transit and at rest, server logs, IP addresses | Germany (EU) | Hetzner DPA |
Last updated: 24 March 2026. We will update this list when sub-processors change and notify users of material changes via the platform.