Legal
Sub-processors
Last updated 8 July 2026
Every third party that processes data on our behalf, and the legal basis for any transfer of data outside the EEA. We do not currently use any other processor. This list is updated whenever that changes.
Current sub-processors
| Processor | What they do | Where | Transfer basis |
|---|---|---|---|
| Netlify, Inc. | Website hosting and content delivery | USA, served from a global edge network | EU Standard Contractual Clauses under Netlify's DPA, plus Netlify's EU–U.S. Data Privacy Framework certification |
| Stripe Payments Europe, Ltd (Ireland), with Stripe, LLC (USA) | Payment processing. Our processor for payments; an independent controller for fraud prevention and its own legal obligations | Ireland (EU) and USA | Contracted with an EU entity; US transfers under EU Standard Contractual Clauses and Stripe, LLC's EU–U.S. Data Privacy Framework certification |
| Plausible | Anonymous page and event counts | EU | None needed — EU processing |
| Supabase (not yet live) | Will store saved results, once that feature ships | To be confirmed — an EU region | None needed if EU |
A note on Stripe
Stripe is not a plain sub-processor. It is our processor for payments and an independent controller for fraud prevention and its own anti-money-laundering and legal duties, as stated in its own Data Processing Agreement.
A note on transfer certifications
Both Netlify's and Stripe, LLC's EU–U.S. Data Privacy Framework certifications are self-asserted on each company's own legal pages. Even where a certification has lapsed, the EU Standard Contractual Clauses in each company's DPA independently provide the transfer basis.
Provided for general information and transparency. This page is not legal or medical advice.