Subprocessors
Version 1 · published 2d ago
Subprocessors
Controller / Provider: Zero Folks AB, trading as Koya Labs Last updated: see the version stamp at the top of this page. Questions: [email protected]
This page lists the third parties we engage to help operate Weblooks. It supports the Privacy Policy and the Data Processing Agreement, under which you give general written authorisation for us to engage the subprocessors listed here.
How to be notified of changes
We give 30 days' notice before adding or replacing a subprocessor that processes personal data, and you may object on reasonable data-protection grounds during that period — see DPA section 5.
To receive notices, email [email protected] with the subject "subprocessor notifications" and the address to notify.
Core infrastructure subprocessors
These are engaged for every customer.
| Subprocessor | Role | Data processed | Processing location |
|---|---|---|---|
| Hetzner Online GmbH | Application servers, PostgreSQL database, Redis cache | All account, project, collaboration, audit, and consent data held in the primary database | Germany (`eu-central`) |
| Cloudflare, Inc. | CDN, DNS, WAF, Workers (staging serving and the CMS edge API), R2 object storage, Cloudflare Access for staff admin | Site content and assets, uploaded project files, avatars, published deployments; request metadata including IP addresses at the edge | Global edge network; object storage placement is automatic across Cloudflare's regions unless a location hint is configured |
| Functional Software, Inc. (Sentry) | Error monitoring and performance tracing | Error events, stack traces, request metadata, and error-triggered session replays. Replays are captured with all text masked and all media blocked; no normal-session replay is collected | European Union (Sentry EU region) |
| Resend (Plus Five Five, Inc.) | Transactional email — sign-in links, account and security notices, invitations, comment and mention alerts, support status updates | Recipient email address, message content, delivery metadata | United States |
| Infisical, Inc. | Secret management for platform credentials | Platform secrets and configuration only. No Customer Content and no personal data | United States |
Engaged when the relevant feature is enabled
| Subprocessor | Role | Data processed | Processing location | Engaged when |
|---|---|---|---|---|
| Adyen N.V. | Payment processing, subscription billing, 3-D Secure | Billing contact details, payment metadata, transaction records. Full card details are handled by Adyen and are not stored by Weblooks | Netherlands (EU) | You purchase a paid plan |
Integrations you choose to connect
These are not our subprocessors. When you connect one, you instruct us to exchange data with it on your behalf, and your relationship with that provider is governed by their own terms and privacy notice. You are responsible for the lawful basis for that transfer.
| Provider | What connecting it does |
|---|---|
| GitHub, Inc. | Two-way sync of project source between Weblooks and a repository you control |
| Vercel Inc. | Deploys your built site to a Vercel project you control |
| Third-party CMS providers | Reads and writes content from a CMS you connect |
| Object storage you configure | Stores your project assets in a bucket you control, under Pattern-1 independence |
| Analytics, tag management, and marketing platforms | Loads scripts you add to your own published site. These run on your visitors' browsers under your control, not ours — you are the controller for that processing |
Not subprocessors
For clarity, the following are sometimes assumed to be subprocessors and are not:
- Supabase Studio — self-hosted by us on the same Hetzner instance as the database. It is an administration UI; no data leaves our infrastructure.
- Google Fonts — display fonts are downloaded at build time and served from our own origin. No visitor request reaches Google.
- Google (via Cloudflare Access) — used to authenticate our own staff to the admin subdomain. It processes staff identity, not customer personal data.
Onward transfers
Where a subprocessor processes personal data outside the EEA, we rely on the European Commission's Standard Contractual Clauses together with a transfer impact assessment, or on an applicable adequacy decision. Details are available on request at [email protected].