This is an English translation of the current French provider register. The independent Azure recovery repository below is live and has passed production database and asset restore tests.
1. Understanding this list
This page supplements the privacy notice and the Data Processing Agreement. It distinguishes subprocessors that may process content entrusted by a professional customer from providers or recipients used for Flying Golem’s own account, security or payment purposes.
Plumelin’s permission matrix—owner, editor, reader and collaboration profiles—determines what invited users may do in a project. It does not replace this list: users authorised by a customer are not Flying Golem providers, while the companies below provide infrastructure or technical services.
2. Subprocessors that may process Customer Data
Hetzner Online GmbH
- Service
- Hosting the application, API, PostgreSQL and temporary export files.
- Data
- Technical accounts, synchronised workspaces, manuscripts, fictional worlds, comments, roles, metadata and export files.
- People
- Users, collaborators and people mentioned in entrusted content.
- Location
- Nuremberg, Germany, eu-central network zone.
- Transfer
- Processing in the European Economic Area; no third-country transfer mechanism is required for this primary processing.
Microsoft France SAS and relevant Microsoft affiliates — Azure Blob Storage
- Service
- Encrypted independent PostgreSQL backup, continuous transaction log archiving and recovery copies of project assets.
- Data
- Encrypted database generations and project image objects. The recovery account does not host the live application database.
- People
- Users, collaborators and people mentioned in entrusted content.
- Location
- France Central primary region and France South geo-redundant secondary region.
- Safeguards
- Private containers, encrypted backup payloads, HTTPS-only access limited to the production server, versioning, thirty-day deletion recovery and monitored restore drills.
ActiveCampaign, LLC — Postmark
- Service
- Sending sign-in codes, invitations, collaboration notifications, security messages and contractual communications.
- Data
- Recipient email address, limited subject and message content, message identifier and technical delivery data. Manuscript text is not attached to ordinary messages.
- People
- Users, invited collaborators and support contacts.
- Location
- United States, with ActiveCampaign’s published technical subprocessors.
- Transfer
- EU–US Data Privacy Framework where applicable and European Commission Standard Contractual Clauses provided by the supplier agreement.
Microsoft France SAS and relevant Microsoft affiliates — Azure AI Foundry
- Service
- Optional assisted analysis during import, only after an express user action.
- Data
- Submitted text windows, technical instructions, proposed responses and metadata strictly necessary for the request. Flying Golem keeps no separate cache of prompts or responses.
- People
- Users and people who may be mentioned in submitted fragments.
- Location
-
France Central resource with
DataZoneStandardprocessing limited to regions covered by Microsoft’s European Union Data Boundary. - Transfer
- Prompts and responses are processed within the published European zone for this deployment. Microsoft states that it does not make them available to OpenAI or use them to train foundation models.
3. Providers and recipients for other processing
Sold through Link, LLC and the relevant Stripe entities
- Service
- Stripe Managed Payments, ordering, payment, invoicing, indirect tax, fraud prevention, refunds and transaction support.
- Data
- Identity and billing details, country, address, company name and tax number where provided, plan, amount, payment method and status, invoice, subscription and refund. Flying Golem does not receive the complete card number, expiry date or security code.
- Role
- Link acts as merchant of record for the transaction. Stripe and Link also determine processing required for their payment, tax, anti-fraud and regulatory obligations; they are therefore not presented as subprocessors of Customer manuscripts.
- Location and safeguards
- Processing may occur in the United States and other countries depending on the Stripe service, using the mechanisms Stripe describes for each role and transfer.
Microsoft France SAS and relevant Microsoft affiliates — Azure Static Web Apps
- Service
- Hosting and distributing the public plumelin.com website.
- Data
- Requests and technical visit data needed to provide and secure the public website. Private projects are not hosted by this static website.
- Location
- West Europe Azure resource, distributed through Azure infrastructure.
- Role
- Flying Golem’s processor for operating the public website, not a subprocessor of Customer Data hosted in the application.
4. Authorised personnel and collaborators
Flying Golem directors and authorised personnel are not additional subprocessors. Access is limited to operational, security, billing or support needs through named accounts, least privilege, multi-factor authentication where available and a confidentiality obligation.
Collaborators invited to a project by its owner act under that owner’s or organisation’s authority. The Customer controls their roles, permissions and revocation in Plumelin.
5. Changes and objections
A professional customer covered by the Data Processing Agreement is informed before a subprocessor that may access Customer Data is added or replaced, under the procedure and notice period in that agreement. A reasoned data-protection objection may be sent to privacy@plumelin.com.
The date at the top identifies the current translation. History: initial French list published 5 August 2026; Azure recovery repository added and English translation prepared 15 August 2026 after backup and restore validation.