Sub-processors

This list is referenced from the Privacy Policy and the Data Processing Agreement. It is updated when a sub-processor is added, removed, or replaced. Changes affecting end-user data trigger the 30-day notification described in data-processing-agreement.md, section 7.

Sub-processor	Purpose	Location	Data involved	Transfer mechanism	DPA link
Cloudflare, Inc.	Edge compute (Workers), key-value cache (KV), database (D1), request analytics (Analytics Engine), bot/abuse challenge (Turnstile)	D1 database, the only persistent store of record, created with a Western Europe location hint, a preference Cloudflare honours on a best-effort basis, not a guarantee; edge compute and the KV cache run on Cloudflare's global network with no data residency control	Hashed email address and domain (cache), API key hash, IP address, `Origin` header, user agent. Cookies set: `cf_clearance` (challenge passage, 30 minutes) and `__cf_bm` (bot mitigation, 30 minutes from last request); see `privacy-policy.md`, section 9.3 for the full cookie table.	Cloudflare Data Processing Addendum; Standard Contractual Clauses for transfers outside the EEA; EU-U.S. Data Privacy Framework self-certification where applicable, status to confirm at publication	https://www.cloudflare.com/cloudflare-customer-dpa/
Polar.sh	Merchant of record: checkout, subscription billing, invoicing, VAT handling, usage metering	United States (Polar Software, Inc., Delaware)	Customer (account holder) name, billing address, payment metadata; no card data	Standard Contractual Clauses (EU SCCs, Module 2) per Polar's Data Processing Addendum	https://polar.sh/legal/data-processing-addendum
DeBounce	Email deliverability verification, paid slow-path only, invoked only when a request opts into a deliverability check with a secret key	[CONFIRM: DeBounce's data-center country for its validation API; DeBounce's own privacy policy names no country or region for this, stating only that data "is processed at the Owner's operating offices and in any other places where the parties involved in the processing are located"]	Plaintext email address submitted for verification. This is the only sub-processor in this table that receives a plaintext address; every other row receives a hashed address, so this exception is material. DeBounce's privacy policy states that data submitted through its Google Sheets integration is not stored, but publishes no equivalent statement for the plain REST validation endpoint used here, so [CONFIRM: whether DeBounce retains the submitted address on the REST API path; no public statement either way]	[CONFIRM: transfer mechanism cannot be assessed until DeBounce discloses a processing location; an EU-based operator cannot complete this row without that answer from DeBounce]	[CONFIRM: DeBounce publishes no public sub-processor list; its privacy policy states the current list "may be requested from the Owner at any time" (no public URL as of 2026-09-16); request directly from DeBounce and link here once received]
Google LLC / Google Ireland Limited	Google Analytics 4, website analytics, consent-gated, routed through a first-party server-side gateway	United States (Google LLC) and/or EU (Google Ireland Limited) depending on configuration	Pseudonymous website usage data, collected only after cookie consent. Cookies set: `_ga` (2 years) and `_ga_<container-id>` (2 years), both first party via the same-origin analytics gateway; see `privacy-policy.md`, section 9.3 for the full cookie table.	Google's EU-U.S. Data Privacy Framework self-certification; [CONFIRM: current status and which Google entity is the data importer for this account]	https://business.safety.google/adsprocessorterms/
Google Workspace	Account and support email, calendar, internal documents	EU	Correspondence content with account holders and prospects	Google Workspace Data Processing Amendment; EU-U.S. Data Privacy Framework self-certification where applicable	https://cloud.google.com/terms/data-processing-addendum/