Last updated: 9 November 2026
AutoExplore Oy uses the providers below to operate GitComet and support its users and contributors. Some process information on our behalf; others have their own responsibilities as controllers. This list includes both so their roles are visible.
The Pro service's servers, database and backups are in AWS's Stockholm, Sweden region. This is not an EU-only processing commitment. Account traffic passes through a global delivery network, firewall request logs and the delivery network's certificates and firewall configuration are in the United States, and several providers operate internationally.
Providers processing information for GitComet
| Provider | Purpose and information | Processing location |
|---|---|---|
| Amazon Web Services EMEA SARL | Pro hosting, database, backups, object storage, key management, content delivery, firewall, security monitoring and transactional email. Processes account and identity data, device and licence records, organisation information, billing notifications, in-app reports, logs and email content | Servers, database and backups in Sweden. The delivery network processes traffic in locations worldwide. Firewall request logs, certificates and firewall configuration are in the United States |
| Cloudvisor, UAB (Vilnius, Lithuania; registration no. 304155531) | AWS partner through which we buy AWS. Manages billing for our AWS accounts and retains administrative access to them, so it can technically access the information AWS processes for the Pro service | Lithuania (EU). The information itself stays in the AWS locations above |
| Microsoft Ireland Operations Limited — Microsoft Azure | Hosting, DNS and delivery for gitcomet.dev and docs.gitcomet.dev, the APT package repository, and the waitlist's application, database and monitoring services. Produces aggregate traffic statistics for the websites. Processes request information, waitlist email addresses, optional comments and, with consent, visit attribution including campaign and click identifiers | Azure regions in the EU, with a global delivery network and international support operations |
| Microsoft Ireland Operations Limited — Microsoft 365 | Email for gitcomet.dev addresses. Processes support, privacy, billing and contributor correspondence and attachments | Microsoft data centres for our tenant's region, and international support operations |
| Google Ireland Limited — Google Analytics and Google Tag Manager | Optional website and documentation analytics, loaded only after consent. Processes page and interaction information, referrers, device and browser information, approximate location and measurement identifiers. Advertising features are disabled | International processing under Google's applicable data-processing and transfer terms |
| GitHub, Inc. | Source hosting, builds, security tooling, release distribution, update checks and contribution management. Processes public contributor identities, commits, issues, pull requests, agreement-check status, request metadata and development records | United States and other locations used by GitHub |
The AWS and Azure entries cover the related storage, computing and monitoring services; we do not use a hosted identity vendor for Pro's sign-in database. GitHub also acts as a controller for its own user accounts and platform operations. A provider's role depends on the processing involved, not just its presence in this table.
Payments and contributor agreements
Stripe Payments Europe, Ltd., with Stripe, Inc. handles payments, subscriptions, tax and invoices. It processes contact and billing details, tax identifiers, payment-method information and transaction records. Stripe has independent controller responsibilities for parts of this processing and operates internationally, including in Ireland and the United States. Our service also receives payment notifications containing some of those details; full card numbers and card security codes are not sent to us.
SAP SE — CLA Assistant hosts electronic contributor-agreement acceptance. It processes GitHub identity and email information, details entered in the agreement form and acceptance records, which authorised project administrators can access. SAP's published CLA Assistant privacy statement identifies SAP as the controller and describes international transfers. We therefore list SAP separately rather than claiming an established processor relationship or EU-only storage for contributor records.
Services you choose to use
Forge hosts, external sign-in providers and an organisation's own identity provider process information under their own arrangements with you or your organisation. Pro's forge requests go directly from the desktop to the chosen provider, with credentials held on the device. App owners may receive installation or authorisation information from the provider.
Pro's optional AI features use the model you configure: a local model, an OpenAI-compatible or Anthropic endpoint with your own API key (such as OpenAI, Anthropic or OpenRouter), or a coding-agent tool signed in with your own account (Claude Code, Codex, OpenCode or GitHub Copilot). Pro and those tools send changes, code and other context to that provider. AutoExplore does not host inference or relay those requests. An AI provider's retention and other processing are governed by its own terms.
Google also operates the YouTube player on our video pages, which loads only when you press play, and the Google Forms used for optional user surveys in the open-source client; for these it acts under its own terms. Our Discord community server is run on Discord's platform under Discord's terms.
GitHub, image hosts and package distributors may also receive requests from update checks, remote images, installer downloads or crash reports you choose to share. In particular, opening a pre-filled GitHub crash report sends its contents to GitHub before an issue is posted. These requests are separate from website analytics.
Limits and safeguards
The account service has no third-party analytics or advertising tags. Its application resources are served from its own origin, although its software includes open-source dependencies. Public-site fonts are self-hosted; we do not use Google Fonts.
Normal desktop use does not upload local repositories to AutoExplore. Content you choose to share through support, crash reporting or contributions can nevertheless include code, file paths or other personal information and can be processed by the relevant providers above.
Transfers for which we are responsible use the safeguards required by applicable law. The Privacy Policy explains the data categories, retention, rights and international processing in more detail. Contact gitcomet@gitcomet.dev for information about applicable safeguards.
Changes to this list
We update this list when we add or change a subprocessor, and when the other recipients or processing arrangements described here change. Organisation administrators who want to be told of changes can ask at gitcomet@gitcomet.dev; objections can be sent to the same address.
Related
AutoExplore Oy, Annankatu 11, 53100 Lappeenranta, Finland
Business identity code 3495946-3
Privacy enquiries and objections: gitcomet@gitcomet.dev