Legal

Sub-processors

Every third party that processes data on zeypm’s behalf — what it does, where it processes, and the transfer mechanism that covers it. There is no third-party analytics, advertising or tracking provider, so none appears here. This is the whole list.

Last updated 11 August 2026

ProviderRole in the serviceProcessing locationTransfer mechanism
Cloudflare
Cloudflare, Inc. (US)
Hosts and serves the application (edge compute/CDN), stores uploaded files, cache, transactional email sending, bot protection (Turnstile), AI Gateway proxyGlobal edge networkEU–US Data Privacy Framework + SCCs
PlanetScale
PlanetScale, Inc. (US)
Managed Postgres database — all structured application dataAWS eu-west-2 (London, UK)EU→UK adequacy; DPF/SCCs for support access
AWS
Amazon Web Services, Inc.
Underlying cloud infrastructure for the database (engaged via PlanetScale)eu-west-2 (London, UK)EU→UK adequacy
Anthropic
Anthropic, PBC (US)
AI features — processes content explicitly sent through an AI action; not used for model trainingUnited StatesEU–US Data Privacy Framework + SCCs
Google
Google LLC (US)
Only if your organization enables it: Google sign-in, Google Docs/Drive embedsUnited States / globalEU–US Data Privacy Framework
GitHub
GitHub, Inc. (US)
Only if your organization connects repositories: PR, commit and issue references, code context for agentsUnited States / globalEU–US Data Privacy Framework

Not a sub-processor, listed for transparency: Paddle.com Market Ltd (UK) is the merchant of record for all purchases — it sells the subscription, processes payment and tax data as an independent controller, and its own privacy policy applies to checkout.

Transfers from the EEA to the United Kingdom rely on the European Commission’s adequacy decisions for the UK, renewed 19 December 2025 and valid to 27 December 2031. We announce sub-processor additions or replacements at least 30 days before they take effect — see the Data Processing Agreement.