Subprocessors

Who processes personal data for tidekeeper, where, and what for.

For your sites' data

The data processing agreement at /dpa refers to this list. We tell owners by email at least 30 days before adding to it or replacing one, as the agreement says.

• Hetzner Online GmbH, Germany. The machines tidekeeper and its database run on, in Nuremberg, Germany, and the backups, in Helsinki, Finland. Everything tidekeeper holds.
• Scaleway SAS, France. Passes on the mail tidekeeper sends: sign-in links, alerts and reports. Sees the address each goes to and what it says, which can include your sites' figures.

Visitors' countries are looked up in DB-IP's database on our own machine. Nothing is sent to DB-IP.

For tidekeeper's own customers

What we hold as the controller, about the people who sign in and those who write to us (the privacy policy at /privacy), also goes to:

• Stripe Payments Europe, Ltd., Ireland, for accounts on a paid plan. Takes payment and writes invoices. Sees the account's billing details and the card, which tidekeeper never sees. Where a plan is sold through Stripe Managed Payments ("Sold through Link"), Sold through Link, LLC, United States, a Stripe company, is the merchant of record for its payments, and a controller of its own for that data.
• Google Ireland Limited, Ireland, for those who sign in with Google. Sees that you sign in to tidekeeper.
• GitHub, Inc., United States, for those who sign in with GitHub. Sees that you sign in to tidekeeper.
• Google Cloud EMEA Limited, Ireland (Google Workspace). Holds the mail sent to our addresses, and what the contact form sends. Sees what you write to us.

These providers can reach data from outside the EEA. Where they do, it is under the safeguards the GDPR asks for, as each provider's own agreement says.