Legal
Subprocessors
The short version
- Five companies touch data on our behalf, and this page names every one of them.
- All Service data is stored in the European Union. Email, error monitoring and backups run on our own servers.
- A new subprocessor is added to this page before it handles your data, and the change log records every addition and removal with the date.
This page is the list the Privacy Policy and the Data Processing Agreement refer to.
1What a subprocessor is#
A subprocessor is a company we engage that processes personal data on our behalf while we run the Service for you: the host our servers run on, the company that takes your payment, the AI provider that reads a comment to classify it. We add one only when the Service needs it, and each is bound by written terms that protect your data at least as well as our own agreement with you.
2The list#
| Subprocessor | Purpose and data | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting, storage and backups of all Service data: accounts, workspaces, connected pages and their tokens, comments, messages, actions and insights. | Germany (EU). No transfer outside the EU. |
| Stripe, Inc. | Payment processing, invoicing and the billing portal. Receives the name, email address, billing address and phone number you give at checkout, and the card details you enter on Stripe's own pages. | United States. Standard contractual clauses and the EU-US Data Privacy Framework. |
| Meta Platforms, Inc. | The platform APIs the Service is built on. Comments and messages come from Meta, and the actions you take (hide, delete, reply) go back to it with the page's token. | United States. Standard contractual clauses in Meta's platform terms. |
| OpenAI and compatible AI API providers | Comment classification by meaning, translation and reply drafting. Receives the text of a comment, the author's display name where a rule needs it, your rule notes and the text you ask to translate. Never your account details or page tokens. Processed under API terms that exclude training on customer content. | United States. Standard contractual clauses in the provider's data processing terms. |
| Cloudflare, Inc. | Bot protection on the sign-in and registration forms. Receives the IP address and browser details of a visitor who opens those forms. | United States. Standard contractual clauses and the EU-US Data Privacy Framework. |
3What is not on the list#
- Email. Service emails (invitations, password resets, usage warnings, digests) are sent from our own mail server. No email provider sees them.
- Error monitoring. Runs on our own servers. When it records how a screen behaved during an error, every text is masked and every image is blocked.
- Backups. Copied daily to a second server of ours, in the European Union, and deleted after 14 days.
- Location by IP address. The approximate country of a visitor is read from a database file on our own servers, so no geolocation service receives the address. The one exception is the pricing page's local currency line, described in the Cookie Policy.
- Push notifications. A notification you enable travels to your device through your browser vendor's push service (Apple, Google or Mozilla), encrypted end to end as the Web Push standard requires, so the vendor cannot read it.
- Meta as a controller. When we measure our own ads with the Meta Pixel and Conversions API, Meta receives data from our websites for its own purposes and is a separate controller, not our subprocessor. Section 12 of the Privacy Policy describes exactly what is sent.
4Changes#
We keep this page current. A new subprocessor is added before it handles your data, one that stops handling it is removed, and the change log below records both with the date. This page is the notice of such changes; check it as often as your compliance process requires. By continuing to use the Service after a change, you accept the subprocessors listed here.
The authorisation this page rests on is section 5 of the Data Processing Agreement.
5Change log#
- September 12, 2026: this page published. The five subprocessors are the ones the Privacy Policy has listed since it was first published; none was added or removed.