Legal
List of sub-processors
In short
- This is the complete list of parties that see any of your data, and what they do with it.
- Most of it stays in the Netherlands. There are four places where the answer is not "simply European", and these are named explicitly.
- Services you might expect here — translation, the moderation model, visitor figures — have deliberately been left off: these run on our own server.
- This list is built automatically from the components that Debaty actually uses. It cannot lag behind reality.
On this page
What is a sub-processor?
In brief: a service provider that processes personal data on our instructions, under a contract that the law prescribes.
To make Debaty work, we engage a small number of service providers. If such a party processes personal data on our behalf, this is called a sub-processor and we conclude a processor agreement for it: a contract for which the AVG (article 28) prescribes what it must contain. The core of it is that they only do what we instruct, and nothing for themselves.
Not every party that sees something of yours is a sub-processor. Whoever determines for themselves what happens with the data is an independent controller, and then such a contract would be legally incorrect. That difference determines who you need to turn to if something goes wrong, so it is set out here for each party.
How this list comes about
In brief: it is generated from the components that are running, not maintained by hand.
Debaty keeps one list in the source code of everything that is running: which component it is, who manages it, in which country it is located and under which law it falls. This page, the provenance page and your own data passport all read from that same list.
That is not tidy housekeeping but a necessity. This page has in fact fallen behind in the past: it said that your photos were on our own storage while they were already with Cloudflare, and the privacy statement next to it said the correct thing. A list that is maintained by hand falls behind as soon as someone forgets to update it — and no one notices, because no error message appears. Now a test breaks as soon as a service is added that is not described here.
The sub-processors
In brief: these four process data on our instructions.
| Party | What they do | Where | Basis |
|---|---|---|---|
| Onworx BV | Provides the machine that Debaty runs on. Everything is stored there: the database, the sessions, the conversations, the back-ups. They do not look inside it — they supply the hardware, we determine what happens on it. | Netherlands | Processing agreement (AVG art. 28) |
| Cloudflare | Sits as a security layer in front of debaty.com and intercepts the traffic before it reaches our own server. As a result, everything you do on Debaty passes through it: the pages you request, the messages you post, your login attempt. Cloudflare terminates the secure connection, so that traffic is readable there, and in doing so sees your IP address. We use that layer to ward off attacks and abuse, not to track you: there is no Cloudflare cookie on your device and we link nothing to your account. | varies per visitor | Processing agreement (AVG art. 28) |
| Cloudflare | Stores the photos and videos you upload. The storage is private: the files are not directly accessible, they reach you via Debaty. | European Union | Processing agreement (AVG art. 28) |
| Veriff | Checks your identity document, and only if you start that check yourself. We get to see the outcome, not your documents. | Estonia | Processing agreement (AVG art. 28) |
| Mistral AI | Gives a second opinion on a message that our own moderation software cannot resolve. Only then does the text of that one message leave — without your name, your account or your IP address. | France | Processing agreement (AVG art. 28) |
Parties that are responsible in their own right
In brief: these two decide for themselves what they do; that is why there is no processing agreement.
| Party | What they do | Where | Basis |
|---|---|---|---|
| Mollie | Handles your payment for Debaty+. Your payment details go directly to Mollie; we never see an account or card number. | Netherlands | Mollie's own responsibility — no processing agreement, see below |
| KLIPY | Supplies the GIFs in the picker. Only your search term goes to them via our server; the previews also run through us, so your browser never talks to them directly. | Georgia | KLIPY's own responsibility — we do not send along any data about you |
Why there is no contract underlying this. With Mollie, your payment details go directly from you to Mollie; we are not in between and see no account or card numbers. Mollie decides for itself how it processes that data, has its own privacy policy for it, and is answerable for it itself. A processing agreement would assert that we are the ones in charge, and that is not the case. With KLIPY it is different but comes down to the same thing: we do not send along any data about you at all, only the search term that you type.
Your browser's push service
In brief: we do not choose this party — your browser does.
| Party | What they do | Where | Legal basis |
|---|---|---|---|
| Debaty | Delivers a push message to your device. Which service that is, is determined by your browser and not by Debaty: with Chrome it is Google, with Safari Apple, with Firefox Mozilla. The text of the message passes through it. | varies per visitor | We do not choose this party and have no contract with it — turn off push messages and nothing goes through |
If you turn on push messages, your browser creates an address with its own push service and gives it to us. We send the message to that address. Which party is behind it depends on your browser and not on us — and it is the only row on this page where we have not chosen the party ourselves. If you turn off push messages, nothing goes through.
What is not a sub-processor
In brief: this runs on our own server, even though you might expect an external service.
| Component | What it does | Where |
|---|---|---|
| Debaty | Counts visitor numbers. Self-hosted, without cookies, not linked to your account and never on administration pages. | Netherlands |
| Debaty | Translates a message when you tap "translate". Our own software on our own server: the text never goes to an external translation service. | Netherlands |
| Debaty | Determines which language a message is written in, so that it reaches the right moderation software. Our own software on our own server. | Netherlands |
| Debaty | The language model that flags possible violations. Our own software on our own server; only in cases of doubt is a message sent to Mistral (see above). | Netherlands |
Our mail server is also our own: an e-mail from Debaty does not pass through an external sending service. The same applies to the database, the sessions and the search function.
Where it is not simply European
In brief: five honest caveats, because leaving them out would make the rest of this page worth less.
| Where | What is going on |
|---|---|
| Cloudflare (the security layer in front of the site) | Since 7 August 2026 all traffic to debaty.com first arrives here, and the secure connection is terminated there — so this is the party that sees the most of your traffic. Cloudflare is an American company. Unlike the storage below, there is no jurisdictional boundary: which data centre handles your request depends on where you are. For visitors from the Netherlands that is Amsterdam. |
| Cloudflare R2 (your photos and videos) | The files are held in the EU — that is a hard setting of the storage, not a promise. But Cloudflare is an American company, and so the American CLOUD Act continues to apply. Both are true and we let them both stand. |
| KLIPY (the GIF picker) | Based in Georgia, outside the EU. That is why we send nothing about you over to it: only your search term, via our server. Your browser never talks to it directly. |
| The push service | Could be located anywhere, because your browser chooses it. |
| The domain name | Our registrar is based in Germany, but the registry behind .com is operated by an American company. That touches none of your personal data, but it belongs in the list. |
The full list of everything that runs and the law it falls under is on the provenance page. The transfer exceptions are also in the privacy statement.
If this list changes
In brief: you don't need to keep an eye on this — a change appears in the changelog.
If we start using a new party or stop using an existing one, this page automatically changes along with it: it is built up from the components that are actually running.
We report such a change in two places. The date at the bottom of this page moves forward, and the changelog gets an extra line. You can follow that overview; so you don't need to keep an eye on this page yourself.
We don't send you a separate e-mail for each change. We don't promise that, because we wouldn't live up to it: writing to a list of all members for every technical change is something that happens once and then peters out. If something significant changes about who processes your data, then you will hear about it — through the announcement that accompanies the terms of use, thirty days in advance.
Version and changes
In brief: this is version 1.0 of this document, adopted on 23 July 2026.
- v1.0 — 23 July 2026. First adopted, complete version of this document.
Language and validity
In brief: the version you read is the one that applies to you — a translation included.
This document is available on Debaty in fourteen languages. The version in your language applies to you, and it binds us too. Where a translation differs from the Dutch text, the reading that is most favourable to you applies: we cannot hold our own translation error against you.
Dutch is the language in which we write changes and against which we check translations. That is a working arrangement inside our company, not a ranking between readers. If a translation lags behind the Dutch text, we say so at the top of the page, with both dates.
Wherever you live, the mandatory consumer law of your own country continues to apply, whatever else is written here.
Last updated: August 7, 2026