Vinius Sub-processors
Last updated: August 19, 2026
A sub-processor is a third party that processes personal data on our behalf in order to deliver the Vinius platform. This page lists every one of them.
We publish it because clause 5.6(c) of the Terms and Conditions and Section 6 of the Data Processing Agreement commit us to maintaining a current list, and because you should be able to see who touches your data without having to ask.
How we manage sub-processors
Each sub-processor below is engaged under a written agreement imposing data protection obligations equivalent to those we owe you. We remain responsible to you for their performance.
Before we add or replace a sub-processor, we give 30 days' notice by email and update this page. If you have a DPA with us, you may object on reasonable data protection grounds within that period. If we cannot resolve the objection, you may terminate the affected services without penalty and receive a pro-rata refund for the unexpired term.
To be notified of changes, write to privacy@govinius.com.
Current sub-processors
| Sub-processor | Purpose | Personal data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| DeltaBlue NV, on OVHcloud infrastructure | Application hosting, PostgreSQL database, object storage, cache | All data stored in or processed by the Platform | France, EU | Not required. Processing takes place in the EU |
| OpenAI Ireland Ltd | AI inference for the AI Sommelier and data enrichment | Prompt content you submit, which may include free text and wine context | Ireland, EU | Not required at this level. Any onward transfer by OpenAI to its non-EEA affiliates is made under Standard Contractual Clauses |
| WorkOS, Inc. | Authentication and identity: login, SSO, organization membership | Email address, name, authentication identifiers, organization membership | United States | Standard Contractual Clauses |
| Resend (Plus Five Five, Inc.) | Transactional and lifecycle email delivery | Email address, name, message content | United States | Standard Contractual Clauses, and certification under the EU-US Data Privacy Framework |
Notes
Where your data lives. The Platform, its database, object storage, and cache are hosted in the European Union, in France. The region is fixed with our hosting provider rather than left to their discretion, so your inventory, lots, movements, pricing, orders, and content stay in the EU.
AI and model training. OpenAI is our only AI provider, and we contract with its Irish entity, so inference for European customers is an EU-to-EU arrangement. Content sent to the OpenAI API is not used to train or improve OpenAI models. We do not use your content to train third-party foundation models.
No analytics or advertising trackers. The Platform loads no analytics, advertising, or marketing trackers. There is no Google Analytics, Segment, PostHog, Mixpanel, Hotjar, or Meta pixel. That is why no such vendor appears above.
Payments. No payment processor is currently integrated. When billing is introduced we will add the processor to this page with notice, as described above.
Questions
Write to privacy@govinius.com. For the wider picture of how we handle personal data, see the Privacy Policy and the Data Processing Agreement.