Sub-Processors

1. Scope

This page lists the sub-processors that SubPro engages to provide the Service described in our Terms and Privacy Policy. SubPro remains responsible for the acts and omissions of its sub-processors as if they were its own, in accordance with the Data Processing Agreement (DPA) that forms part of each Publisher's SaaS Subscription Agreement.

Material changes to this list are notified to Publishers by email with not less than 30 days' advance notice; Publishers may object and terminate before the new sub-processor is engaged.

2. Current Sub-Processors

Name	Purpose	Data Categories	Region	Transfer Mechanism
Cloudflare, Inc.	Workers compute, D1 (SQLite), R2 (object storage), KV (key-value cache), DNS, CDN, WAF.	All Publisher and Member personal data; service logs.	Global edge (US-headquartered).	SCC (EU); UK IDTA; CCPA contractual addendum.
Mux, Inc.	Video encoding, signed-URL delivery, thumbnail generation, playback analytics.	Video assets, playback events, signed-URL request metadata.	US (with global edge delivery).	SCC (EU); UK IDTA.
Paddle.com Market Limited	Merchant of record for Publisher SaaS subscription fees; checkout, invoicing, tax remittance, billing communications.	Publisher billing identity, invoice records, last-four payment-instrument digits.	UK (with EU and US presence).	UK GDPR; SCC (EU); Paddle's own DPA covers downstream.
Resend (Resend, Inc.)	Transactional and account email delivery (verification, password reset, billing alerts, system notifications).	Recipient email address, message content, delivery metadata.	US.	SCC (EU); UK IDTA.

3. Limited-Purpose Recipients (Not Sub-Processors)

The following parties may receive personal data in defined circumstances but do not act as sub-processors of SubPro:

NCMEC CyberTipline — recipient of mandatory CSAM reports under SubPro's NCMEC ESP registration. SubPro acts as the reporting entity, not in a controller-to-processor transfer.
Law enforcement and regulators — where compelled by valid legal process under applicable law. Disclosure is logged and, where lawful, the affected data subject is notified.
Publisher's own merchant of record (Lemon Squeezy / Stripe / Komoju / etc., chosen by each Publisher) — receives Member transaction data directly from the Publisher's site. SubPro is not in the data path for Member-to-Publisher payments.

4. Data Residency Notes

Cloudflare's edge architecture means personal data may transit and be cached close to the requesting user's network edge. Persistent storage (D1, R2) is served from Cloudflare's primary regions; Publisher and Member data are not deliberately replicated to any specific country. Where a Publisher has a data-residency requirement, SubPro can configure region-restricted D1 placements on request; contact privacy@sub-pro.net.

Japan's status under the European Commission's adequacy decision is relied on for transfers from the EEA to SubPro's home jurisdiction. Onward transfers from Japan to US sub-processors rely on SCCs / UK IDTA as listed above.

5. Updates

This list is current as of the page footer date. SubPro maintains an internal change log of sub-processor additions, removals, and material changes; Publishers may request the change log under the DPA.

6. Contact