Subprocessors
Last changed 7 October 2026 · Version 1.1
These are the third-party services that may process personal data when we provide TidyKB. Each one is bound by a data processing agreement with us. This page is Annex III of our Data Processing Addendum.
Get notified of changes. Email privacy@tidykb.net with the subject "Subprocessor updates" and we will email you at least 14 days before we add or replace a subprocessor. Account owners are notified automatically.
Contents
- Subprocessors
- Not subprocessors: services that act on their own account
- Self-hosted tools
- Change history
Subprocessors
| Subprocessor | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH | Servers, database, nightly backups | All service data | Germany (EU) | Not needed (EU) |
| Anthropic, PBC | AI translation drafts | Title and text of the articles in a translation batch you start, and your glossary | United States | SCCs (Anthropic DPA) |
| Resend (Plus Five Five, Inc.) | Transactional email: sign-in and verification emails, audit reports, weekly health reports | Recipient email address, email content (issue summaries, article titles) | United States | SCCs |
| Cloudflare, Inc. | Turnstile, the bot check on the free audit form | The Turnstile token and the IP address the check sees | Global network | Data Privacy Framework; SCCs |
| Porkbun LLC | DNS for our domains, and forwarding for our hello@, support@ and billing@ addresses |
Email you send to those addresses, in transit | United States | Not yet confirmed |
| Google LLC | The mailbox our support address is forwarded into | Emails you send us and our replies | United States / global | Data Privacy Framework; SCCs |
| Ahrefs Pte. Ltd. | Website analytics on the marketing pages (Ahrefs Web Analytics) | Page URL, referrer, browser and device type, and a country derived from the IP address. Cookieless: nothing is stored on your device and no cross-site profile is built. Not loaded at all if your browser sends Global Privacy Control or Do Not Track. | Singapore, with EU edge processing | Data Processing Addendum with SCCs |
| PostHog, Inc. | Analytics on the marketing site and the sign-in pages (PostHog EU Cloud) | Which pages are visited and which steps are completed, plus a first-party identifier stored on your device. Never your name or email address, and nothing from inside the signed-in app. Session recording is off. Not loaded at all if your browser sends Global Privacy Control or Do Not Track. | European Union | Data Processing Addendum with SCCs |
Not subprocessors: services that act on their own account
| Service | Role |
|---|---|
| Creem | Merchant of Record and seller for every purchase, in 190+ countries. Takes the payment, owns tax compliance, and handles refunds and chargebacks. Processes payment and billing data as an independent controller under its own privacy notice. Registered as Armitage Labs OÜ, registry code 16977866, Rotermanni 14, Tallinn 10111, Estonia. |
| Google LLC (Sign in with Google) | Authenticates you if you choose Google sign-in; Google's privacy policy applies. |
| Freshworks Inc. (Freshdesk) | Your own help-desk provider. TidyKB connects to your Freshdesk account on your instructions; Freshworks is not our subprocessor. |
Self-hosted tools
These run on our own servers at Hetzner in Germany, so no third party receives data through them: Postgres (database), GlitchTip (error tracking), and Grafana/Loki (logs).
Change history
| Date | Change |
|---|---|
| 2 October 2026 | First version. |