Subprocessors

SCYN Scan UG (haftungsbeschränkt), Stridbeckstraße 28, 81479 München, Germany (“SCYN”, “we”) operates the website scyn.io, the SCYN API (api.scyn.io) and the SCYN apps for iOS and Android. This page lists our subprocessors (Unterauftragsverarbeiter): companies that process personal data on our behalf and under our instructions as processors within the meaning of Art. 28 GDPR, together with the subcontractors those companies have disclosed to us.

Which personal data we process, for which purposes and on which legal basis is explained in our Privacy Notice. This page complements it and is intended in particular for business customers who need the information for their own records of processing activities.

At a glance

  • All our processors are established in the EU, and all data we store — accounts, images, scan events, backups — is held exclusively in Germany.
  • We do not engage any processor established in the United States.
  • We do not use analytics, tracking or advertising providers on scyn.io or in the apps.

1. Processors (Art. 28 GDPR)

1.1 Hetzner Online GmbH

Industriestr. 25, 91710 Gunzenhausen, Germany

  • Services: Hosting of the SCYN backend, API, web frontend, PostgreSQL database and Redis on a Hetzner Cloud server; storage of uploaded images (logos, Disclets); encrypted backups on a Hetzner Storage Box; delivery of our transactional e-mail (for example password resets and notifications) via Hetzner’s mail servers.
  • Location: Server in Nuremberg, Germany (Hetzner data center nbg1); backups in Falkenstein, Germany (Hetzner Storage Box). Both in the EU.
  • Data: All personal data processed by SCYN is stored on this infrastructure: account and login data, business and billing master data, uploaded images, pseudonymised scan events, server logs, and the addresses and content of transactional e-mail.
  • Agreement: Data processing agreement pursuant to Art. 28 GDPR (Hetzner AV-Vertrag, version 1.2, 16 February 2026), concluded on 9 October 2026.

Subcontractors approved under the Hetzner agreement

Annex 3 (“Genehmigte Subunternehmer”) of the Hetzner agreement lists the subcontractors below. Under the agreement, server data of customers who have chosen an EU server location — as we have — is processed exclusively within the EU, and support services for all server locations are provided from within the EU. We reproduce the annex in full; the entries for the USA and Singapore relate to server locations we do not use and therefore do not process any SCYN data. Purposes are translated from the German original.

  • Hetzner Finland Oy, Huurrekuja 10, 04360 Tuusula, Finland — Building lease, technical support (server location: Finland)
  • Hetzner US LLC, 1500 Broadway, 19th Fl, New York, NY 10036, USA — Rental of servers at the US location (server location: USA)
  • NTT Global Data Centers Americas, Inc., 1625 National Drive, Sacramento, CA 95834, USA — Colocation provider at the US location (server location: USA)
  • QTS Investment Properties Hillsboro, LLC, 12851 Foster Street, Overland Park, KS 66213, USA — Colocation provider at the US location (server location: USA)
  • Hetzner Singapore Pte. Ltd., 1 Scotts Road, #21-10 Shaw Centre, Singapore 228208, Singapore — Rental of servers at the Singapore location (server location: Singapore)
  • NTT Global Data Centers SG1 Pte Ltd, 8 Kallang Avenue #15-01/09, Aperia, 339509 Singapore, Singapore — Colocation provider at the Singapore location (server location: Singapore)

1.2 BunnyWay d.o.o. (bunny.net)

Slovenia (EU)

  • Services: Content delivery network (CDN) in front of the website scyn.io only. bunny.net’s edge servers answer requests to scyn.io from a location close to the visitor and fetch the pages from our origin server at Hetzner. The API (api.scyn.io) — including every scan, upload, login and dashboard request — is not routed through the CDN and is served directly by our Hetzner server. We use the CDN service only; no other bunny.net product (storage, video, e-mail or AI features) is in use.
  • Data: Request metadata processed at the edge in order to deliver the page (IP address, requested URL, user agent, referrer, time) and anonymised access logs and traffic statistics.
  • Location: Provider established in Slovenia (EU). Visitors in Europe are served from European edge locations.
  • Agreement: Data processing agreement concluded on 9 October 2026.

Sub-processors published by bunny.net

bunny.net publishes its sub-processors at https://bunny.net/gdpr/sub-processors/. The list below reproduces that page as published by bunny.net and retrieved on 11 October 2026 (the page itself states no revision date). None of these companies is involved in delivering scyn.io content: according to bunny.net they serve its own customer support, e-mail and opt-in AI features and receive data only when a customer uses those services, which we do not. Data residency as stated by bunny.net.

  • ZenDesk — Customer support ticketing; may receive names, e-mail addresses and any logs a customer includes in a support request (data residency: Europe)
  • Slack — Customer support communication; may receive names, e-mail addresses and any logs a customer includes in a support request (data residency: United States)
  • Google Workspace — E-mail communication between bunny.net and its customers (data residency: Europe)
  • MailChannels — Outbound e-mail delivery for bunny.net customers who use bunny.net to send e-mail to their own clients (data residency: United States)
  • OpenAI — Opt-in AI features (support chatbot, video transcription for Bunny Stream, image and content generation); zero data retention where supported (data residency: United States)
  • Atlassian — Internal bug tracking and feature requests; account owner information is passed on from ZenDesk (data residency: Europe)

2. Independent recipients (not subprocessors)

The following companies receive personal data in specific situations but process it under their own responsibility as independent controllers. They do not act on our instructions and are therefore not subprocessors; their own privacy policies apply.

Mollie B.V.

Amsterdam, Netherlands — payment processing. When you subscribe to a paid plan or buy the custom-shapes add-on, the payment is processed by Mollie (credit card, bank transfer, Pay by Bank). Mollie receives the data required to execute the payment (name, e-mail address, billing address, payment method details, amount). Payment details are entered on Mollie’s hosted checkout and never reach SCYN. Mollie processes this data as an independent controller for payment processing.

Apple Inc. / Google LLC

The App Store (Apple Inc.) and Google Play (Google LLC) distribute the SCYN apps. This applies only if you install the app through one of these stores. The store operator processes your store account, download and update data under its own terms. We do not sell subscriptions or add-ons through the app stores; all paid plans are purchased on scyn.io.

Transactional e-mail

Transactional e-mail is sent from Hetzner’s mail servers under the Hetzner data processing agreement (see 1.1). We do not use a separate e-mail service provider.

3. Processing we keep on our own infrastructure

  • Geolocation: Where we derive an approximate location (country, city) from an IP address, this is computed locally on our server from a copy of the MaxMind GeoLite2 database. No external lookup takes place and no data is sent to MaxMind (see Open Source Credits).
  • Image recognition: Logo matching and Disclet decoding run entirely on our own server. No external AI or image-processing API receives scan images.
  • Analytics: We operate no third-party analytics, tracking or advertising service.

4. Changes to this list

We update this list when a subprocessor is added or replaced; business customers can ask to be notified at legal@scyn.io. Questions about this list can also be sent to that address.

Last updated: October 2026. Hetzner annex: version 1.2, 16 February 2026. bunny.net sub-processor list retrieved 11 October 2026.