Current list
| Sub-processor | Purpose | Data transferred | Location |
|---|---|---|---|
| Google LLC (Firebase Cloud Messaging / Google Push Service) | Delivering notifications to Chrome and Android devices | Push endpoint address, encrypted notification payload | USA / global |
| Mozilla Corporation (autopush) | Delivering notifications to Firefox browsers | Push endpoint address, encrypted notification payload | USA / global |
| Apple Inc. (APNs / Safari Push) | Delivering notifications to Safari and iOS devices | Push endpoint address or device token, encrypted notification payload | USA / global |
| Microsoft Corporation (WNS) | Delivering notifications to Edge browsers | Push endpoint address, encrypted notification payload | USA / global |
| Paddle.com Market Ltd. | Taking payments, invoicing and subscription management (as merchant of record) | Account email, billing and payment details | United Kingdom / EU |
| Brevo (Sendinblue SAS) | Transactional email: address verification, password reset, system and quota alerts | Account email address, email content | EU (France) |
| Google Ireland Ltd. / Google LLC (Google Analytics 4) | Measuring visits to the marketing site — in cookieless mode unless consent is given; advertising and personalisation signals are off in every case | Truncated IP address, browser/device details, pages visited; plus a cookie identifier only if consent is given | EU / USA |
Why push services are unavoidable
Under the web push standard, a notification can only reach a user’s browser through the push service run by that browser’s vendor: Google for Chrome, Mozilla for Firefox, Apple for Safari, Microsoft for Edge. We have no way to choose that service; the browser decides the endpoint address when the subscription is created.
Notification content is delivered to those services end-to-end encrypted under RFC 8291. The push service sees only the destination endpoint and the encrypted payload; it cannot decrypt the title or body.
Services we do not use
For transparency: we use no ad network, heatmap or session-recording service. No third-party code runs in the panel. The marketing site carries Google Analytics for measurement, and it loads only if you give explicit consent. A CDN distributes the SDK file only; that file collects no personal data.
Notice of changes
Before adding a new sub-processor to the list we update this page and notify the email address on your account a reasonable time in advance. If you object to a new sub-processor, you have the right to end your subscription.