Auxillo is operated by Jaundre van Staden, trading as Auxillo, an individual trader (Empresário em Nome Individual), NIF 309215099, CAE 58290, 62202 and 63110. Address: Rua da Comporta 12, 2D, 8500-454 Portimão, Portugal.
1. How to read this list
This list names every outside organisation that receives personal data when Auxillo delivers its services, with its role, the data it receives, where it processes it and the safeguard for any transfer outside the European Economic Area (EEA). It is Annex 3 of the Data Processing Agreement.
- Subprocessor: processes data on Auxillo’s behalf and only on its instructions, under a written agreement meeting Article 28 GDPR (the support-drafting entry is the exception described in section 6).
- Independent controller: decides for itself how it processes the data it receives, under its own privacy notice.
- Lookup service: receives only the domain, IP address or email address that a customer asked Aux Tools to check, and returns public or reputation information about it.
2. Subprocessors
| Provider | Role and purpose | Personal data | Location | Transfer safeguard and agreement |
|---|---|---|---|---|
| Hetzner Online GmbH, Germany | Subprocessor. Hosting: the servers that run every Auxillo service. | All service data stored on Auxillo servers: account data, hosted content, mail, databases, Aux Tools data, logs. | Germany and Finland (EU) | No transfer outside the EEA. Data processing agreement under Article 28 GDPR concluded with Hetzner. |
| Cloudflare, Inc., United States | Subprocessor. DNS, content delivery, secure tunnels to Auxillo servers, network protection, Turnstile bot checks on forms where enabled, and storage of encrypted off-site recovery archives. | IP addresses and request details of visitors and users; traffic passing through its network; encrypted archives it cannot read. | Global network; company in the United States | EU to US Data Privacy Framework and standard contractual clauses. Cloudflare Data Processing Addendum. |
| Stripe Payments Europe, Limited, Ireland, and Stripe, Inc., United States | Independent controller for payment processing, fraud prevention and its legal duties; subprocessor for the billing records it keeps for Auxillo (subscriptions, invoices). | Billing name and address, email address, tax number, payment details, transaction history, device signals in checkout. | Ireland and the United States | EU to US Data Privacy Framework and standard contractual clauses. Stripe Data Processing Agreement. |
| Google LLC (Firebase Cloud Messaging), United States | Subprocessor. Delivers push notifications to the Aux Tools and Aux Mail apps when you allow notifications. | Device push token and an opaque identifier. Notifications are data-only and carry only that identifier: no message content is sent through Google. | United States | EU to US Data Privacy Framework and standard contractual clauses. Firebase Data Processing and Security Terms. |
| Clearbit (HubSpot, Inc.), United States | Subprocessor, only if an Aux Mail customer switches on contact enrichment. Off by default. | Email addresses and domains of the customer’s contacts that are sent for enrichment. | United States | EU to US Data Privacy Framework and standard contractual clauses, under Clearbit’s data processing terms. |
| Internet Security Research Group (Let’s Encrypt), United States | Certificate authority. Issues the TLS certificates for Auxillo and customer domains. | Domain names and validation requests. Certificate domain names are published in public certificate transparency logs. | United States | Domain names in certificates are public by design. Let’s Encrypt privacy policy. |
| Anthropic and OpenAI (United States and other regions) | Subprocessor, for support only. AI models that sort support messages, gather technical context and draft replies. Jaundre van Staden reads every ticket and approves every reply before it is sent. No reply is sent automatically. | Minimised text of a support ticket sent to [email protected]. Email addresses, IP addresses, telephone numbers, long numbers, secrets and recognisable names are removed or replaced before it is sent. This is pseudonymisation, not anonymisation. Never sent: messages to [email protected], abuse reports, evidence, appeals, privacy and data-subject requests, legal orders, identity documents, payment card details, and hosted customer content (site files, mailboxes, databases). Support looks at hosted customer content only with the customer’s explicit permission for that ticket, and it is never put into a model. | United States and other regions | A written agreement under Article 28 GDPR and a recorded transfer mechanism are required before this use starts. Until both are in place, and the exclusions listed for this entry are enforced, it stays switched off. |
3. Independent controllers
| Provider | When it receives data | Personal data | Location |
|---|---|---|---|
| Google LLC, Microsoft Corporation, GitHub, Inc. | Only if you choose to sign in to Auxillo with that provider. | The sign-in request; the provider returns your account identifier, name and email address to Auxillo. | United States, under each provider’s own terms and Data Privacy Framework certification |
| Your own AI provider in Aux Tools | Only if you connect your own model or agent (from the Professional plan). | The findings you choose to send to it. | Where you chose; under your own agreement with that provider |
| Your browser’s push service (for example Google, Mozilla or Apple) | Only if you allow browser notifications for an Auxillo app. | An end-to-end encrypted notification that the push service cannot read, and your browser’s push address. | Where your browser vendor operates it |
| Mail providers and recipients | When you send mail, or connect an external mailbox to Aux Mail. | The messages and address data needed to deliver mail. | Where the recipient or provider is |
4. Lookup services used by Aux Tools
When you run a check in Aux Tools, the domain, IP address or email address you entered is sent to the service that answers that check. Nothing else about you or your account is sent. Breach checks run only for your own email address or addresses at a domain you have verified. Each service answers under its own terms.
| Service | Purpose | Data sent | Location |
|---|---|---|---|
| Have I Been Pwned | Whether an email address appears in known data breaches | Your own email address, or an address at a domain you have verified | Australia |
| AbuseIPDB | IP address reputation and abuse reports | IP address | United States |
| Shodan | Open ports and services seen on an IP address or host | IP address or host name | United States |
| SecurityTrails | DNS and registration (WHOIS) history, only when this check is enabled | Domain name | United States |
| Globalping | Ping, traceroute, DNS and HTTP tests from probes around the world | Domain name or IP address | Worldwide probe network |
| crt.sh (Sectigo) | Search of public certificate transparency logs | Domain name | United Kingdom |
| Cert Spotter (SSLMate) | Certificate transparency monitoring | Domain name | United States |
| Robtex | DNS and network relationships | Domain name or IP address | Sweden (EU) |
| HackerTarget | Reverse IP lookup, used only when Robtex cannot answer | IP address | Australia |
| Team Cymru | IP address to network (ASN) mapping | IP address | United States |
| ARIN (rdap.arin.net) | Network range and holder of an IP address, from public registration data (RDAP) | IP address | United States |
| RIPE NCC (rdap.db.ripe.net) | Network range and holder of an IP address, from public registration data (RDAP), asked when the registries above cannot answer | IP address | Netherlands (EU) |
| APNIC (rdap.apnic.net) | Network range and holder of an IP address, from public registration data (RDAP), asked when the registries above cannot answer | IP address | Australia |
| LACNIC (rdap.lacnic.net) | Network range and holder of an IP address, from public registration data (RDAP), asked when the registries above cannot answer | IP address | Uruguay |
| AFRINIC (rdap.afrinic.net) | Network range and holder of an IP address, from public registration data (RDAP), asked when the registries above cannot answer | IP address | Mauritius |
| rdap.org | Registrar name for a domain, from public registration data (RDAP); it passes the request to the registry for that domain ending | Domain name | Varies with the domain ending |
| HSTS Preload List (hstspreload.org, Google) | Whether a domain is on, or can join, the browsers’ HSTS preload list | Domain name | United States |
A domain name or IP address is personal data only where it identifies a person, for example a personal domain or an email address. Where it is, and the service is outside the EEA, the transfer is necessary to perform the check you asked for (Article 49(1)(b) GDPR), or is covered by the service’s standard contractual clauses where it offers them.
5. What Auxillo runs itself
Auxillo runs its own mail servers, databases, application software and AMI on its own servers and hardware. These are not outside organisations, so they are not listed above. AMI runs only on hardware that Auxillo owns and operates in Portugal, with local models; no external AI provider receives AMI conversations. See the AMI Policy.
Aux Command and Aux Proton Drive Bridge run on your own equipment and send nothing to Auxillo. They collect no telemetry, account or usage data.
6. Transfers and changes
Every subprocessor is bound by written data protection obligations meeting Article 28 GDPR, and every transfer outside the EEA has the safeguard stated above. The one exception is the support-drafting entry for Anthropic and OpenAI. This entry is part of the advance notice of that use; customers are also told by email, as the Data Processing Agreement describes. It will not start until its written agreement and transfer mechanism are recorded, and not earlier than 30 days after this entry was published. Ask [email protected] for a copy of a safeguard relevant to your service.
We give customers at least 30 days’ notice of a new or replacement subprocessor for customer-controlled processing, with the objection process described in the DPA. We update this list before the change takes effect.
Last updated: 29 October 2026.