Subprocessors and service providers

DataVisitors uses external providers to operate the service. The register below covers hosting, network delivery, backup storage, and payments. It describes the information each service can handle.

A subprocessor handles customer personal data on our behalf. Some providers also act as independent controllers for their own legal, security, or payment obligations. Their role depends on the activity, not only their name.

Hostinger supplies the hosting infrastructure. Cloudflare handles network traffic and protection. Cloudflare R2 stores database backups. These services can handle personal data even where the analytics event itself does not retain an IP address.

Network processing can occur in multiple countries. A provider's registered office does not establish where a particular request or backup is processed. A single-country or European-only storage commitment does not apply unless we confirm it in a separate written agreement.

If your organisation requires a specific location, contact us before sending data. Request the current hosting and backup locations for your assessment.

Stripe processes subscription payments and related billing information. It can act as a processor or an independent controller, depending on the payment activity. Routine payment processing does not require your visitors' analytics events.

Account and service messages contain information needed to deliver them, such as a recipient address, invitation, security notice, or report. Your own email provider also receives messages sent to your address. Contact us for the current outbound delivery provider and the information needed for your vendor assessment.

Your own integrations, webhook destinations, report recipients, and AI assistants receive information when you authorise them. They are not automatically our subprocessors. You are responsible for your relationship with those services and the permissions you grant.

Our public pages also request the Inter font from rsms.me. That host receives ordinary request information when the font loads. See the Privacy Policy for this website data flow. A provider listed here is not an advertising partner.

For processing covered by an agreed Data Processing Agreement, we will give advance written notice of a new or replacement subprocessor. The agreement provides thirty days to raise a reasonable data protection objection.

Send an objection through the contact page. Identify your workspace, the provider, and the data protection concern. We will discuss a practical solution. If no solution is available, the agreement explains how to end the affected service before the change applies.

The following register also appears in the Data Processing Agreement. The Privacy Policy explains the data categories and retention periods.