Subprocessors

PostHog

PostHog provides the usage analytics, the crash reports and the session recordings. We use the EU environment: events are processed in Germany. Your browser sends everything meant for PostHog to groei.tuinontwerp.app: the events, and on every visit, consent or not, the fetch of two script files. The region is fixed when the project is created and cannot be changed afterwards. PostHog, Inc. is a US company based in San Francisco; the data processing agreement incorporates the EU Standard Contractual Clauses and PostHog participates in the EU-US Data Privacy Framework.

groei.tuinontwerp.app is a forwarding address (a reverse proxy) that PostHog runs for us. We chose a name that ad blockers do not recognise, so that we measure more visits from people who allow analytics; that is why we name the address here. The address does not decide what is measured: your choice in the cookie notice does. PostHog has the traffic to this address handled by Cloudflare Workers. According to PostHog, the proxy removes cookies from every request before it goes on to PostHog, stores nothing, and Cloudflare keeps no log lines of it. The traffic usually arrives at a Cloudflare location in Europe, but that is not guaranteed: from a country outside Europe it arrives at a location there.

PostHog engages parties of its own. For the EU environment those are Amazon Web Services (storage, Germany), PlanetScale (database monitoring, Germany), Modal Labs (compute, Germany), Wiz (security, Germany and France) and Cloudflare (network and traffic handling).

Open point, still to be checked by a lawyer: for Amazon Web Services, PlanetScale and Modal Labs, PostHog gives the location as “USA (PostHog US Cloud) or Germany (PostHog EU Cloud)”. We are on the EU environment, so for us that reads as Germany. For Cloudflare the location is given as “global edge locations, worldwide” for data in transit. What that means for transfers outside the EU, and whether PostHog's US entity itself can reach the data, has to be established before public launch.

The data processing agreement with PostHog was accepted on 29 September 2026.

• PostHog's data processing agreement (opens in a new tab)
• PostHog's current subprocessor list (opens in a new tab)

Tally

Tally BV (Belgium) provides the waiting-list sign-up form and receives what you enter in it. By its own account Tally stores that data in Europe. According to Tally, its data processing agreement is part of the terms accepted when the account was created; there is no separate signature.

Tally engages parties of its own, among them Google Cloud, Cloudflare, SendGrid, Sentry, Mixpanel and OpenAI; according to Tally some of these may also process form submissions. Which of them sit outside the EU, and what that means for transfers, has to be established before launch.

The embedded form loads only when you open the waiting list. From that moment it connects, inside its own frame on tally.so, to Sentry in the United States. See the privacy statement under ‘The waiting list’.

• Tally's privacy and GDPR page (opens in a new tab)

Zoho

Zoho provides our email: the mailboxes at tuinontwerp.app, among them privacy@tuinontwerp.app and hello@tuinontwerp.app. Zoho receives what you email us, and the feedback you send from the design tool: your message, your email address if you give one, and your design with your address if you send it along. We use Zoho's EU environment; according to Zoho its data centres are in Amsterdam and Dublin.

Zoho concludes a data processing agreement on request. Whether one has been concluded for our account, and which parties Zoho itself engages and where they are, must be recorded before launch and reviewed by a lawyer.

• Zoho's GDPR page (opens in a new tab)

Hosting

tuinontwerp.app runs on Cloudflare Workers. Cloudflare serves the site and processes your request data, including your IP address, in order to deliver the page and to keep abuse out. For 1 percent of requests to the site Cloudflare keeps a log line with the method, the page address, your IP address, your browser and an approximate location, for 7 days. Requests to the AI connection (/mcp and /api/mcp/tab) are not logged by Cloudflare itself: our server writes its own log line for each, without your IP address, kept for 7 days. What such a line holds is in the privacy statement.

Cloudflare is listed here because it is our hosting provider. Traffic to groei.tuinontwerp.app does not pass through our hosting: that address points to PostHog, which engages Cloudflare for it itself (see PostHog above).

Cloudflare also runs the login screen of the design tool (Cloudflare Access, with a one-time code by email) and the relay between your open design and your own AI app (a Durable Object), which your tab connects to only when you get a link code. Access keeps each login attempt for 24 hours, and a list of who has logged in. The relay stores no design and is not pinned to the EU.

Parties your browser reaches directly

When you enter an address, your browser looks the parcel up at PDOK, the Dutch government's public data service, and at the Kadaster. Your browser fetches building heights from 3DBAG, a dataset by TU Delft and 3DGI. All of these requests go straight from your browser to those services, not through our server. They see your IP address when it does. PDOK and the Kadaster also receive the address you search for, 3DBAG an area around your parcel.

These parties are not subprocessors. They are public data sources we query. Whatever they record themselves falls under their own terms.

Changes to this list

If a party is added or drops off, we update this page and note the date at the top.