Sub-Processors
Last updated: 2026-05-31
This page lists every third party that processes personal data on Trunq's behalf under Art. 28 GDPR. A Data Processing Agreement (DPA) is in place with each of the providers below.
| Provider | Location | Purpose | Data processed | Transfer basis | Privacy |
|---|---|---|---|---|---|
| Supabase | EU (Frankfurt, Germany) | Primary database and file storage (avatars). | All account data: profile, library, ratings, reviews, lists, follows, sessions, uploaded images. | — | open |
| Vercel | USA (with EU edge regions) | Application hosting, edge network, build and deployment infrastructure. | Request logs, IP addresses, browser user-agent, performance telemetry. | EU Standard Contractual Clauses (Art. 46 GDPR) and Vercel's Data Processing Addendum. | open |
| IONOS | Germany | Outbound email delivery (verification, password reset, ticket replies, account deletion confirmation) and inbound support mailbox hosting. | Email addresses, email subject + body, sender / recipient metadata. | — | open |
| Resend | USA | Fallback email delivery (only used if IONOS SMTP is unavailable; not active in production today). | Email addresses, email subject + body (only on failover). | EU Standard Contractual Clauses (Art. 46 GDPR). | open |
| Sentry | Germany (EU data residency) | Error and performance monitoring of the application. | Error context, stack traces, IP address, browser/device fingerprint, optionally a non-reversible internal user ID. | — | open |
| Upstash | EU (Frankfurt, Germany) | Redis-backed rate limiting for API endpoints (abuse prevention). | Hashed identifiers (user ID or IP address) and request counters with short TTL. | — | open |
| TMDB | USA | Movie and TV show metadata, posters and backdrops. Trunq queries this API server-side only — no personal user data is forwarded. | Only server IP and search queries (no user identifiers). | — | open |
| AniList | United Kingdom | Anime and manga metadata. Trunq queries this API server-side only. | Only server IP and search queries (no user identifiers). | — | open |
| Movie of the Night (via RapidAPI) | USA | Streaming availability lookup (which services a title is on in your region). Trunq queries this API server-side only. | Only server IP, title ID and region code (no user identifiers). | — | open |
Supabase
open →Location
EU (Frankfurt, Germany)
Purpose
Primary database and file storage (avatars).
Data processed
All account data: profile, library, ratings, reviews, lists, follows, sessions, uploaded images.
Vercel
open →Location
USA (with EU edge regions)
Purpose
Application hosting, edge network, build and deployment infrastructure.
Data processed
Request logs, IP addresses, browser user-agent, performance telemetry.
Transfer basis
EU Standard Contractual Clauses (Art. 46 GDPR) and Vercel's Data Processing Addendum.
IONOS
open →Location
Germany
Purpose
Outbound email delivery (verification, password reset, ticket replies, account deletion confirmation) and inbound support mailbox hosting.
Data processed
Email addresses, email subject + body, sender / recipient metadata.
Resend
open →Location
USA
Purpose
Fallback email delivery (only used if IONOS SMTP is unavailable; not active in production today).
Data processed
Email addresses, email subject + body (only on failover).
Transfer basis
EU Standard Contractual Clauses (Art. 46 GDPR).
Sentry
open →Location
Germany (EU data residency)
Purpose
Error and performance monitoring of the application.
Data processed
Error context, stack traces, IP address, browser/device fingerprint, optionally a non-reversible internal user ID.
Upstash
open →Location
EU (Frankfurt, Germany)
Purpose
Redis-backed rate limiting for API endpoints (abuse prevention).
Data processed
Hashed identifiers (user ID or IP address) and request counters with short TTL.
TMDB
open →Location
USA
Purpose
Movie and TV show metadata, posters and backdrops. Trunq queries this API server-side only — no personal user data is forwarded.
Data processed
Only server IP and search queries (no user identifiers).
AniList
open →Location
United Kingdom
Purpose
Anime and manga metadata. Trunq queries this API server-side only.
Data processed
Only server IP and search queries (no user identifiers).
Movie of the Night (via RapidAPI)
open →Location
USA
Purpose
Streaming availability lookup (which services a title is on in your region). Trunq queries this API server-side only.
Data processed
Only server IP, title ID and region code (no user identifiers).
Changes are announced here at least 30 days before they take effect. Questions go to support@trunq.de.