Sub-processors
Everyone who touches your data, what they do with it, and where they are. Thirty days' notice before this list changes.
Last updated: 5 September 2026
This page lists every third party that processes personal data on our behalf. It is Annex III to our Data Processing Agreement and is incorporated into it by reference.
We give at least 30 days’ notice before adding or replacing any sub-processor that handles customer data. Notice goes to the email address of each organisation owner. You may object on reasonable data-protection grounds under § 6.3 of the DPA, and if we cannot accommodate the objection you may terminate the affected services without penalty and receive a pro-rata refund.
To be notified of changes, write to legal@keupera.com with the subject “Subscribe to sub-processor updates”.
What is deliberately not on this list
- Your own mail server. Outreach and audit-result emails are sent through the server you configure, under your own sending identity. That provider is your supplier, not ours.
- The systems you connect. WordPress, Webflow, Shopify, Framer and similar platforms receive data because you instructed us to publish to them. They are your counterparties.
- AI clients you connect. If you connect Claude, ChatGPT, Cursor or another client to our MCP server, your data goes to that client at your instruction and under its terms, not ours.
Core infrastructure
These providers hold or transport customer data as part of the platform itself.
| Provider | Purpose | Data received | Location & transfer |
|---|---|---|---|
Supabase Supabase, Inc. 970 Toa Payoh North, #07-04, Singapore 318992 Privacy policy | Primary database, authentication, file storage and serverless functions | All customer data | European Union — AWS eu-west-1, Ireland No third-country transfer |
Hetzner Hetzner Online GmbH Industriestr. 25, 91710 Gunzenhausen, Germany Privacy policy | Servers for the analytics store, the site crawler and the MCP server | Website analytics events, crawl payloads | Germany No third-country transfer |
Netlify Netlify, Inc. 44 Montgomery Street, Suite 300, San Francisco, CA 94104, USA Privacy policy | Application hosting and content delivery | Request metadata and application logs | United States Standard Contractual Clauses |
Commerce
Payment credentials are collected and held by our merchant of record. We never receive your card number.
| Provider | Purpose | Data received | Location & transfer |
|---|---|---|---|
Polar Polar Software, Inc. 3500 South DuPont Highway, Dover, DE 19901, USA Privacy policy | Merchant of record: checkout, subscriptions, metered billing, invoicing and tax | Billing contact, subscription state, usage meters | United States Standard Contractual Clauses |
Artificial intelligence
We operate no model of our own. Customer content is transmitted to these providers only to produce the output you requested. We train nothing on it.
| Provider | Purpose | Data received | Location & transfer |
|---|---|---|---|
OpenAI OpenAI, L.L.C. 3180 18th Street, San Francisco, CA 94110, USA Privacy policy | All text generation, analysis, classification and in-product chat | Prompts, retrieved page content, drafts, workspace extracts | United States Standard Contractual Clauses |
Black Forest Labs BFL GmbH Ingeborg-Krummer-Schroth-Str. 18, 79106 Freiburg im Breisgau, Germany Privacy policy | Image generation for article artwork | Image prompts derived from your article content | Germany No third-country transfer |
Search and web data
Used to retrieve public search results and to render pages you submit for analysis.
| Provider | Purpose | Data received | Location & transfer |
|---|---|---|---|
Bright Data Bright Data Ltd. Habarzel 40, Tel Aviv 6971054, Israel Privacy policy | Search-engine result data, keyword data and backlink discovery | Keywords, domains and target addresses you submit | Israel European Commission adequacy decision for Israel |
Browserless browserless.io, Inc. 23207 NE 192nd Ct, Battle Ground, WA 98604, USA Privacy policy | Headless-browser screenshots of pages submitted for analysis | Target addresses | United States Standard Contractual Clauses |
Communications
Outreach you send through the Services does not appear here: it goes through your own mail server, under your own sending identity.
| Provider | Purpose | Data received | Location & transfer |
|---|---|---|---|
Resend Plus Five Five, Inc. 2261 Market Street, Suite 5039, San Francisco, CA 94114, USA Privacy policy | Transactional and lifecycle email sent by Keupera | Recipient name and email address, message content | United States Standard Contractual Clauses |
Mailgun Mailgun Technologies, Inc. 535 Mission Street, San Francisco, CA 94105, USA Privacy policy | Delivery of contact-form and partner-application messages from keupera.com | Name, email address and message you submit through a form | United States Standard Contractual Clauses |
Connected platforms
Engaged only where you connect the corresponding account.
| Provider | Purpose | Data received | Location & transfer |
|---|---|---|---|
Google Google Ireland Limited Gordon House, Barrow Street, Dublin 4, Ireland Privacy policy | Sign-in with Google, and the Search Console API for a property you connect | Google account profile; search performance data for your property | Ireland, with onward processing by Google LLC Standard Contractual Clauses |
Our own websites
These providers see visitors to keupera.com and app.keupera.com. They do not receive the content of your workspace.
| Provider | Purpose | Data received | Location & transfer |
|---|---|---|---|
PostHog PostHog, Inc. 2261 Market Street #4008, San Francisco, CA 94114, USA Privacy policy | Product analytics, error reporting, and the record of your cookie choices | Feature-usage events, error reports, consent records | European Union — EU Cloud region No third-country transfer for stored data |
TWIPLA Visitor Analytics GmbH Seestraße 76, 82335 Berg, Germany Privacy policy | Website visitor statistics | Page views and visit behaviour on our websites | Germany No third-country transfer |
Simple Analytics Simple Analytics B.V. Hooftlaan 4, 1401 ED Bussum, The Netherlands Privacy policy | Aggregate, cookie-free traffic statistics for keupera.com | Aggregate page-view counts | European Union No third-country transfer |
Affonso ZASolution Stuttgarter Str. 106, 70736 Fellbach, Germany Privacy policy | Affiliate referral attribution and partner commission accounting | Referral identifier and resulting commission records | European Union No third-country transfer |
ip-api Artia International S.R.L. Romania Privacy policy | Fallback lookup of the country associated with a visitor IP address in the analytics product | Visitor IP address, at the moment of lookup only | European Union No third-country transfer |
Contentful Contentful GmbH Ritterstraße 12-14, 10969 Berlin, Germany Privacy policy | Content management for the Keupera blog and resource library | None | Germany No third-country transfer |
A note on transfers to the United States
Where a provider above is marked “Standard Contractual Clauses”, we transfer on the basis of the clauses adopted by the European Commission in Decision (EU) 2021/914, supported by a documented transfer impact assessment.
Several of these providers are also certified under the EU–US Data Privacy Framework, whose adequacy decision remains in force. We do not rely on that Framework as the sole basis for any transfer, because an appeal against the judgment upholding it is pending before the Court of Justice. The Standard Contractual Clauses stand independently of how that appeal is decided.