Draft, pending legal review. This text is a first draft and is not yet in force as reviewed legal advice.
Current subprocessors
| Name | Purpose | Personal data | Location | Transfer mechanism |
|---|---|---|---|---|
| Oracle Cloud Infrastructure | Hosting: servers, database, Redis, and backups | All service data | Frankfurt, Germany (EU) | None (EU) |
| Cloudflare | DNS, CDN, proxy, and DDoS protection for every Adjira host (including the tracker script), and object storage | Request metadata, IP addresses, stored files | Global edge | Standard contractual clauses and the EU-US Data Privacy Framework (see the vendor's DPA) |
| Paddle.com Market Limited | Reseller and merchant of record: checkout, payments, tax, and invoicing | Billing contact, billing address, and payment details | United Kingdom | UK adequacy decision (see the vendor's DPA) |
| Brevo | Transactional email delivery | Recipient email address and message content | European Union | None (EU) |
| Optional Sign in with Google (identity only) | Google account identifier, name, and email address | EU and United States | Standard contractual clauses and the EU-US Data Privacy Framework (see the vendor's DPA) |
IP lookups. Location, network, VPN, datacenter, and Tor checks run on Adjira's own servers against locally stored databases (DB-IP Lite and public lists). No visitor IP address is sent to the providers of those databases, so they are not subprocessors.
Ad platforms. When a customer connects a Google, Meta, Microsoft, or TikTok ads account, Adjira exchanges data with that platform on the customer's instruction and with the customer's own account and agreement. These platforms act for the customer, not for Adjira, so they are not listed above.
Adjira will add error monitoring and metrics providers here, with the notice period in the DPA, before enabling them.
Change notice
We give customers 30 days notice by email before adding or replacing a subprocessor.