How this list works
We share data only with the sub-processors below, each under a data processing agreement, and only for the purpose stated. We notify customers by email at least 30 days before adding a new sub-processor or replacing one, per the Data Processing Agreement.
Payment processing
Stripe, Inc. — processes billing and subscription payments for paid plans. Handles cardholder data directly; we never store full card numbers. Processes account/billing data, not visitor data.
Email delivery
A transactional-email relay configured via SMTP (the specific vendor is an operations choice made at deploy time, not fixed in the application code) — sends account, security and notification email on our behalf. Processes account data (name, email address) and the content of the notification.
Cloud hosting and database
[Placeholder — the production hosting provider and region have not yet been selected; this row must name the actual provider before this list is published, since it materially affects the Data Processing Agreement’s international-transfer section.]
SEO data provider
Not yet contracted. The application supports pluggable SEO data vendors (DataForSEO or SerpApi, selected by configuration) for keyword, ranking and backlink lookups, but as of this document neither has an active contract — the feature fails safely with a clear error rather than serving fabricated data until one is signed. This row will be updated, and customers notified, before a vendor goes live.
Error tracking / observability
Not yet contracted. Errors are currently captured internally via structured application logs rather than sent to a third-party error-tracking service. If one is added later, it will appear here first, with 30 days’ notice.