# Sub-processors

_GDPR art. 28(2) · MVSP Analytics (mvsp.ai)_

Last reviewed: 2026-10-10

MVSP Analytics uses the following sub-processors to deliver the service. New sub-processors will be announced here at least 30 days before they start processing personal data.

| Provider                          | Legal entity                | Purpose                                                          | Processing location            | Safeguards                                            |
| --------------------------------- | --------------------------- | ---------------------------------------------------------------- | ------------------------------ | ----------------------------------------------------- |
| Google Cloud — BigQuery           | Google Ireland Ltd. (IE)    | Storage and querying of anonymised analytics rows                | EU multi-region                | Google Cloud DPA + SCCs where applicable              |
| Google Cloud — Firestore          | Google Ireland Ltd. (IE)    | Storage of site tokens, ads, audit log, erasure queue            | `eur3` (EU)                    | Google Cloud DPA                                      |
| Google Cloud — Cloud Run          | Google Ireland Ltd. (IE)    | Serverless compute (API + admin console)                         | `europe-north1` (Finland)      | Google Cloud DPA                                      |
| Google Cloud — Cloud Scheduler    | Google Ireland Ltd. (IE)    | Daily HTTP invocation of the erasure-drain endpoint              | `europe-west1` (Belgium)       | Google Cloud DPA — no personal data transits          |
| Google Cloud — Cloud Logging      | Google Ireland Ltd. (IE)    | Operational logs (contain no analytics payloads)                 | EU                             | Google Cloud DPA                                      |
| Firebase Hosting                  | Google Ireland Ltd. (IE)    | Static asset delivery, TLS termination                           | Global CDN edge, EU origin     | Google Cloud DPA — only public assets are cached      |
| Resend (e-mail API only)          | Resend, Inc. (US)           | Delivery of transactional e-mail sent through the MVSP Email API (`/email`) | AWS EU (Ireland), via Resend's EU region | Resend DPA incl. EU Standard Contractual Clauses |

## Scope of Resend

Resend is used **only** by the MVSP Email API (`/email`), for transactional e-mail sent by the operator's own applications (e.g. notifications and confirmations from finntannlegen.no). It receives sender, recipient address(es), subject and message body for each e-mail. **No analytics data** (pageviews, events, session ids, IP addresses) is ever sent to Resend, so it does not process personal data on behalf of analytics controllers.

## Not used

- Third-party ad networks or marketing SDKs.
- Google Fonts / Google Analytics / any other Google product embedded in the site.
- Cloudflare / Fastly / other non-Google CDNs.
- MaxMind or other geo-IP databases running on raw IP addresses.
- Session-replay, heatmap, or fingerprinting tools.

## Change log

- **2026-10-10** — Added Resend, Inc. for the MVSP Email API (`/email`). Not used for analytics data.
- **2026-09-30** — Initial published register. Added Cloud Scheduler for the daily erasure-drain job.