Legal changelog & versions
Current document versions, the live subprocessor register, and a public history of material legal updates. Use this page to see what changed — and which text is binding.
Latest corpus release 10 Aug 2026Subprocessor register v3.1 (10 Aug 2026)Binding AVV: German Art. 28 text
Legal map — do not collapse these axes
Several documents share topics but not the same legal role. Mixing them is the usual source of inconsistent customer answers.
AVV vs DPA overview
The German AVV (Art. 28) is the binding processor contract. The EN/DE “DPA overview” pages are short pointers only.
Rule: On conflict, AUVY_AVV_DE.md wins. Never edit overview text as if it were the contract.
German AVV vs English DPA translation
avv-de is binding German law text. avv-en is a courtesy translation with the same version number.
Rule: Bump DE and EN AVV together. Never let the English translation invent extra obligations.
Live register vs AVV Anlage 3 snapshot
trust.auvy.ai/subprocessors is the live register (own version, e.g. v3.1). AVV Anlage 3 / Annex 3 is a dated snapshot that must match.
Rule: Change subprocessors.ts first, then mirror into AVV, PPN §7, DSH §7, and terms Annex C.
B2B vs B2C
Business customers get AGB/GTC + AVV (processor). Consumers get B2C terms; AUVY is controller and the AVV does not apply.
Rule: Do not paste AVV processor language into B2C privacy or consumer terms.
Product Privacy Notice vs Datenschutzhinweise
EN PPN and DE DSH are paired controller notices with matching version numbers.
Rule: Keep EN/DE privacy tables and register references in the same order as the live register.
Optional vs baseline processors
“Optional” means data is sent only when a configured feature path is invoked — not that the vendor is inactive on the register.
Rule: Removed vendors belong only in AVV Änderungslog / changelog history, never in the live baseline body.
OpenPulse
OpenPulse is AUVY-operated EU infrastructure, not a separately verified third-party subprocessor.
Rule: Describe in footnotes / residency copy; do not list as a contracting subprocessor row.
Marketing Impressum vs Trust imprint
www.auvy.ai/legal is canonical for the marketing site. Trust imprint mirrors company particulars and links the product legal register.
Rule: Do not redirect marketing /legal to Trust; keep particulars aligned.
Current published versions
Each file carries its own version number. EN/DE pairs must match. Dates below are the document header dates, not git commit times.
| Document | Version | Updated | Role | Link |
|---|---|---|---|---|
| AGB Geschäftskunden (DE) | 1.6 | 13 Aug 2026 | terms | Open |
| AGB Privatkunden (DE) | 1.6 | 13 Aug 2026 | terms | Open |
| Auftragsverarbeitung — Überblick (DE) | 1.7 | 13 Aug 2026 | courtesy | Open |
| AVV Art. 28 DSGVO (DE) | 1.11 | 13 Aug 2026 | binding | Open |
| Business GTC (EN) | 1.6 | 13 Aug 2026 | terms | Open |
| Consumer GTC (EN) | 1.6 | 13 Aug 2026 | terms | Open |
| Data Processing Overview (EN) | 1.7 | 13 Aug 2026 | courtesy | Open |
| DPA Art. 28 GDPR (EN courtesy) | 1.11 | 13 Aug 2026 | courtesy | Open |
| Erstattungsrichtlinie (DE) | 1.2 | 13 Aug 2026 | policy | Open |
| Refund Policy (EN) | 1.2 | 13 Aug 2026 | policy | Open |
| Widerrufsbelehrung (DE) | 1.2 | 13 Aug 2026 | policy | Open |
| Withdrawal Notice (EN) | 1.2 | 13 Aug 2026 | policy | Open |
| Datenschutzhinweise (DE) | 1.2 | 10 Aug 2026 | notice | Open |
| Product Privacy Notice (EN) | 1.2 | 10 Aug 2026 | notice | Open |
| Acceptable Use Policy (EN) | 1.1 | 3 Aug 2026 | policy | Open |
| Cookies (DE) | 1.1 | 3 Aug 2026 | policy | Open |
| Cookies (EN) | 1.1 | 3 Aug 2026 | policy | Open |
| Impressum (DE) | 1.1 | 3 Aug 2026 | policy | Open |
| Legal Notice (EN) | 1.1 | 3 Aug 2026 | policy | Open |
| Nutzungsrichtlinien (DE) | 1.1 | 3 Aug 2026 | policy | Open |
| Vulnerability Disclosure | 1.0 | 3 Aug 2026 | policy | Open |
| Subprocessor register (live) | v3.1 | 10 Aug 2026 | Register | Open |
Changelog
Material public updates. Older subprocessor narrative detail remains in the German AVV Änderungslog.
13 Aug 2026Terms
Consumer remedies moved into AUVY OS
The public cancellation and electronic withdrawal interfaces now run inside AUVY OS. AUVY Billing remains the isolated system for intake, append-only receipts, audit events, Stripe handoff, and confirmation delivery. Marketing keeps permanent compatibility redirects only. Subprocessor region labels in AVV Annex 3 and privacy notices match the public register (EU with city where known); third-country processing for Resend account metadata and Vercel edge metadata remains in AVV Annex 4.
- AVV / DPA Art. 28 1.101.11
- DPA overview 1.61.7
- Business terms 1.51.6
- Consumer terms 1.51.6
- Refund policy 1.11.2
- Withdrawal notice 1.11.2
10 Aug 2026Corpus release
Removed optional Firecrawl and E2B paths
SideGuide Technologies (Firecrawl) and FoundryLabs (E2B) are removed from the live subprocessor register and mirrored legal annexes. Default web search remains Linkup (EU). Limited third-country processing continues to be documented for Resend account metadata and Vercel edge metadata.
- Subprocessor register v3.0v3.1
- AVV / DPA Art. 28 1.91.10
- DPA overview 1.51.6
- Privacy notices (PPN / DSH) 1.11.2
- Business & consumer terms 1.41.5
3 Aug 2026Subprocessors
Register v3.0 — OpenPulse reclassified; Firecrawl & E2B disclosed
OpenPulse described as AUVY-operated internal EU infrastructure (not a separate contracting subprocessor). Optional Firecrawl URL/PDF parsing and E2B sandbox execution added as production-capable AUVY paths. Unverified AWS backup mapping removed.
- Subprocessor register v2.9v3.0
- AVV 1.81.9
3 Aug 2026Subprocessors
Register v2.9 — OpenPulse baseline for realtime
OpenPulse (EU / Helsinki) added as baseline for encrypted realtime collaboration, messaging, agent streams, and workspace notifications.
- Subprocessor register v2.8v2.9
- AVV 1.71.8
3 Aug 2026Subprocessors
Register v2.8 — Linkup-only web search
Product web_search / web_read exclusively via Linkup SAS (EU / Azure EU). Exa and Firecrawl removed from the baseline.
- Subprocessor register v2.7v2.8
- AVV 1.61.7
3 Aug 2026History
Earlier register moves (v2.2–v2.7)
Identity/product plane on AUVY-operated Hetzner hel1; OpenAI and Gladia removed from baseline inference routing; Exa then Linkup/Firecrawl web-search iterations. Full narrative remains in the German AVV Änderungslog.
- AVV 1.11.6
- Subprocessor register v2.2v2.7