采购参考✦
子处理者
最后更新：2026年9月30日
如何阅读此页面
“子处理者”是代表 Transept 处理个人数据以提供服务的第三方。以下每一行代表一个此类提供商。对于每一个提供商，我们列出了：他们扮演的角色、他们处理数据的区域、他们接收的数据类别、共享该数据的合法依据以及现有的 DPA（数据处理协议）。
付费套餐客户可以通过 support@transept.ai 索取我们的数据处理协议——它将以下提供商的 DPA 作为向下传递条款纳入其中。
当前子处理者
| Provider | Role | Region | Data | Lawful basis | DPA |
|---|---|---|---|---|---|
| Hetzner Online GmbH | Application hosting + Postgres database | Germany (EU) | All account data, documents, translations, glossaries, styleguides | Contract | Signed DPA — Hetzner standard DPA per § 28 GDPR |
| netcup GmbH | Hosting for our self-run AI request monitoring (Langfuse) | Germany (EU) | Account ID and technical details of each AI request (model, timing, token counts, cost, errors). Prompt and output text is masked before it is recorded. | Legitimate interest (fault-finding and cost control) | netcup data-processing agreement per Art. 28 GDPR |
| Cloudflare, Inc. | DNS, content delivery and network proxy for transept.ai and app.transept.ai (TLS, DDoS protection) | Global edge network (the data centre nearest you) | IP address, request metadata and the content of requests and pages in transit | Legitimate interest (security and availability of the service) | Cloudflare Customer DPA, EU-US Data Privacy Framework + SCCs |
| Stripe Payments Europe, Ltd. | Subscription billing + one-time purchases | Ireland (EU) for EU customers; US for non-EU | Billing email, billing country, amount, plan, last-four / brand of card. We never see full card numbers. | Contract | Auto-signed Stripe DPA via dashboard |
| Customer.io | Transactional + marketing email | EU workspace (api-eu.customer.io) | Email, locale, marketing-consent status, send/open/click events for the emails we send you | Contract (transactional) + consent (marketing) | Auto-signed Customer.io DPA via account settings |
| PostHog | Product analytics + error tracking | EU (eu.i.posthog.com) | Browser, only with analytics consent: page views, feature usage, device/browser metadata, session recordings. Server: key in-app actions linked to your account ID, and server errors (pseudonymous without consent). Never document text. | Consent (browser) + legitimate interest (server) | Auto-signed PostHog DPA via organization settings |
| Anthropic, PBC | AI translation (Claude family) | United States | Translation prompts + responses (per request, not retained for training) | Contract (legitimate interest in service delivery) | Anthropic API DPA, SCCs for EU-US transfers |
| OpenAI, LLC | AI translation (GPT family) | United States | Translation prompts + responses (per request, not retained for training) | Contract (legitimate interest in service delivery) | OpenAI API DPA, EU-US Data Privacy Framework + SCCs |
| Google LLC (Gemini API + Vertex AI) | AI translation and translation-memory search (Gemini family) | Google’s global endpoints, mainly United States | Translation prompts + responses (per request; paid API tiers, not used for training) | Contract (legitimate interest in service delivery) | Google Cloud DPA + EU-US Data Privacy Framework |
| Groq, Inc. | AI translation (Llama and other open-weight models) | United States | Translation prompts + responses (per request, not retained for training) | Contract (legitimate interest in service delivery) | Groq API DPA |
| OpenRouter, Inc. | AI gateway to additional models | United States | Translation prompts + responses; routed only to providers that do not store or train on the data | Contract | OpenRouter terms include processor obligations |
| Microsoft Corporation | Sign in with Microsoft (optional) | Global (Microsoft identity platform) | Name, email address and Microsoft account ID — only if you choose Microsoft sign-in | Contract | Microsoft Products and Services DPA |
| Figma, Inc. | Figma import (optional integration) | United States | Figma access tokens and the text of the Figma files you choose to import — only if you connect Figma | Contract | Figma Developer Terms; EU-US Data Privacy Framework |
| Google LLC (Tag Manager, Google Analytics, Google Ads) | Web analytics + ad-conversion measurement | United States | Page-view metadata, click events, hashed email for enhanced conversions (Google Ads only). Loaded only with consent, gated via Consent Mode v2. | Consent | Google Ads Data Processing Terms |
| Meta Platforms, Inc. | Ad-conversion measurement (Pixel + Conversions API) | United States | Conversion event metadata, hashed email + fbclid for click-to-conversion attribution. Loaded only with marketing consent. | Consent | Meta Business Tools Terms — Limited Data Use enabled for EU traffic |
更改
重大更改（新的子处理者、区域更改、添加新数据类别）在对新处理生效之前，会在此页面和隐私政策上提前宣布。对于付费客户，当添加新的子处理者时，我们还会通过电子邮件通知帐户的主要联系人。