Sub-processors
Last updated: July 7, 2026
To run AllMy Support (the "Service"), CoinsTax LLC, doing business as AllMy ("AllMy"), uses a small number of third-party providers. Each is bound by a written agreement to protect the data and to process it only on our instructions. The first table below lists the sub-processors that may process personal data contained in Customer Content on our behalf under our Data Processing Addendum. The second table lists other providers we use for personal data we hold as a controller (our own account, billing, and analytics data); these do not process Customer Content.
This page is referenced by our Data Processing Addendum and should be read with our Privacy Policy. Capitalized terms have the meaning given in our Terms and Conditions and the DPA.
Sub-processors (Customer Content)
| Provider | Purpose | Location | Transfer basis |
|---|---|---|---|
| Hetzner Online GmbH Customer Content and account data, at rest and in processing. | Hosting, compute, the primary application database, and object storage (ticket attachments, inline images, and raw email files). | Germany and Finland (EU) | Stored in the EU. Accessed by AllMy personnel from the United States under Standard Contractual Clauses. |
| Amazon Web Services (AWS) Inbound email content and headers, and any Customer Content or account data processed on AWS. | Receiving inbound support email (SES, us-east-1), and hosting, compute, the primary application database, and object storage where used. AllMy's own transactional email to admins and agents is also sent through SES. Customers' outbound replies are sent through each customer's own email provider, not through AWS. | United States (us-east-1), and the EU where used | Processed in the United States under Standard Contractual Clauses. |
| Cloudflare, Inc. Traffic metadata and content in transit, served assets, and any Customer Content processed on Cloudflare. | Edge network, CDN, DNS, hosting of our web and application front end, and object storage where used. | Global network (United States, EU, and other regions) | Processed across a global network, including the United States, under Standard Contractual Clauses. |
Other providers (our own controller data)
These providers process personal data we hold as a controller. They do not process Customer Content and are not sub-processors under the DPA. We list them here for transparency.
| Provider | Purpose | Location | Transfer basis |
|---|---|---|---|
| Stripe, Inc. Account and billing details of subscribing businesses. | Subscription billing and payment processing. | United States | Standard Contractual Clauses. |
| Google (Google Analytics) Usage and device data of visitors and agents. | Website and product usage analytics, set only where consent is given. | United States | Standard Contractual Clauses. |
International transfers
AllMy's personnel are located in the United States and access personal data from there, and AllMy and its sub-processors may process personal data in the EU and the United States, as shown in the tables above. Where personal data is transferred out of the UK or EEA to a country without an adequacy decision, including the United States, we enter into appropriate safeguards, namely the European Commission's Standard Contractual Clauses and, for the UK, the UK International Data Transfer Addendum. A completed, executable copy is available from [email protected] on request.
Notice of changes
When we intend to add or replace a sub-processor that processes Customer Content with a provider not already listed above, we will give workspace owners at least 30 days' notice before the change takes effect, and we update the "Last updated" date and the list. If you have a reasonable objection on data-protection grounds, contact us during the notice period and we will work with you in good faith, up to and including allowing you to terminate as described in the DPA.
Moving processing between sub-processors that are already listed above, or between the regions of a listed sub-processor, does not require separate notice, provided the protections in our DPA (including any transfer safeguards) continue to apply. The providers above are authorized for the purposes and locations shown, and we may distribute or shift workloads among them.
Contact
Questions about our sub-processors? Contact us at [email protected].