Legal
Subprocessors
Every third party that can touch customer data, what each one sees, and how changes are announced.
Draft — not yet reviewed by counsel.
This document says what the product actually does, written by the people who built it. A lawyer has not read it. It is published in this state because a product with no published policy is worse than one with a policy that admits what it is, and it will be replaced by a reviewed version before the first paid contract.
last reviewed 2026-09-17
The current list
The product is live. The list below is the running system as of this review date.
| Subprocessor | Purpose | What it can see | Where |
|---|---|---|---|
| Hetzner Online GmbH | Application, database, and outbound mail transfer | Everything the product stores: messages, events, account data | Hillsboro, Oregon, United States (application, database, US mail transfer) and Helsinki, Finland (EU mail transfer and warmup mail store) |
| Stripe, Inc. | Card payments, checkout, customer portal, invoices | Account email, plan, and payment details. Not message content. | United States |
| Cloudflare, Inc. | DNS and reverse proxy in front of the public sites | Request metadata (IP, URL, headers) for traffic to the public sites. Not message bodies stored in the product. | Global anycast |
| Google LLC | Optional Google sign-in; inbound mail for our own brand addresses | The Google account email used to sign in, when that option is used | United States |
That is the whole list. There is no analytics vendor, no session-replay vendor, no advertising vendor and no customer-data platform, because the console sets one cookie and it is the session.
Recipient mail servers are listed here only when they process data for us (Google sign-in, and inbound mail to our own brand addresses). When you send a message to a Gmail address, Google receives it because that is what sending mail is, not because we engaged them to process data for us.
Changes
We publish a new subprocessor here at least 14 days before it starts processing anything, and we email the account owner on the same day. If you object in that window, tell us at [email protected]; if we cannot resolve it, you may terminate for that reason with a refund of unused prepaid balance.