Subprocessors
Last updated: 14 August 2026
We use a small number of vetted third parties to run PageDiff. This list is kept current; when it changes, we notify customers and give an opportunity to object.
| Subprocessor | Function | Data | Location | Transfer basis |
|---|---|---|---|---|
| Hetzner Online GmbH | Application & database hosting (servers, PostgreSQL) | All service data (primary store) | European Union (Germany / Finland), current hosting region | In-region, no international transfer |
| Cloudflare, Inc. | Monitor checks: headless page rendering (Workers + Browser Rendering); object storage (R2) for screenshots & HTML; DNS/CDN, bot protection, email delivery | Monitored URLs and the page content fetched at check time, page snapshots & HTML, request metadata, alert emails | United States (company); checks run on Cloudflare's global edge network; R2 storage currently pinned to the EU | EU–US Data Privacy Framework (certified) + SCCs |
| Lemon Squeezy, LLC | Payment processing as Merchant of Record (PCI-compliant) | Name, email, billing & tax details | United States | Merchant of Record (own privacy policy) + SCCs |
| OpenAI OpCo, LLC | AI analysis & summarization of detected changes (current AI subprocessor) | Monitored page content sent for summarization | United States | SCCs (via Data Processing Addendum) |
Our product analytics run on Umami, which we self-host on our own EU infrastructure. Because no data is shared with a third party, Umami is not a subprocessor. It is cookieless and collects only aggregate, non-identifying usage data.
Your primary data currently sits in the European Union, with application and database hosting in Germany and Finland and R2 snapshot storage pinned to the EU. Monitor checks run on Cloudflare's global edge network, so the page content we fetch is processed wherever a check executes; payments and AI analysis are processed in the United States. Transfers outside the EU rely on Standard Contractual Clauses, and additionally on the EU–US Data Privacy Framework where the provider is certified under it. The basis for each provider is in the table above. This describes our infrastructure today rather than a commitment to keep it that way. If it changes, we notify customers as described above. For more on how we handle data, see our Privacy Policy and Security page.