Sub-processors
Last updated 2026-09-21
The list
| Provider | What it does | What it handles | Where |
|---|---|---|---|
| Supabase | Database, authentication and file storage | Account records, project settings, aggregated measurements, uploaded logos | United States / EU (per project region) |
| Vercel | Application hosting and edge network | Request metadata in transit, including visitor IP addresses which are used to derive a country and are never stored by us | Global edge, United States |
| Resend | Transactional email (alerts, reports, account notices) | Recipient email address, message contents | United States |
| Anthropic | Writing the plain-English summary on a monthly report (Agency plan only) | Aggregated performance figures and page URLs for the report. No visitor data, and nothing that identifies a person | United States |
| Google PageSpeed Insights / Chrome UX Report | Lab testing of a page and public field data for a domain | The page URL being tested. No visitor data is sent | Global |
What crosses a border, and what doesn't
Visitor IP addresses reach the edge network in the ordinary course of an HTTP request and are used there to derive a country. They are never written to our database and never reach any other provider on this list. What is stored is a two-letter country code alongside aggregated timings.
The testing API receives only the URL of a page being tested. No visitor data is sent to it.
Processing on your behalf
Where you are the controller of visitor measurement data and we are your processor, the terms of that processing are the ones in our agreement and privacy policy. We process it only to provide the service to you, we impose equivalent obligations on each provider above, and we will tell account holders by email before adding a new one.
If you need a signed data processing agreement for your own records, write to timblenge@gmail.com and we will sign yours or send ours.