1. Infrastructure and hosting

Sub-processor	Purpose	Location	Transfer safeguard
Vercel Inc.	Application hosting, edge delivery and serverless compute.	EU region by default; US (corporate).	SCCs; EU–US Data Privacy Framework where applicable.
Google Cloud (BigQuery, Cloud Storage)	Data warehousing, analytics processing and object storage.	EU region for production data.	SCCs; EU–US Data Privacy Framework where applicable.
Supabase	Primary database and authentication (account credentials, sessions).	EU region.	SCCs where any transfer occurs.
Cloudflare, Inc.	CDN, DNS, bot mitigation and DDoS protection.	Global edge; US (corporate).	SCCs; EU–US Data Privacy Framework where applicable.

2. Payments

Sub-processor	Purpose	Location	Transfer safeguard
Stripe Payments Europe, Limited	Payment processing, subscription billing and fraud prevention.	EU (Ireland); US (group).	SCCs; intra-group safeguards; PCI-DSS.

3. Communications and support

Sub-processor	Purpose	Location	Transfer safeguard
Configured email provider (Resend, SendGrid, or SMTP relay)	Transactional and, where consented, marketing email delivery.	Depends on the provider configured in Global Settings.	SCCs / DPF as offered by the configured provider.
Helpdesk / CRM tooling	Managing support tickets and customer relationships.	EU/US depending on tool.	SCCs / DPF as applicable.

4. Analytics, monitoring and advertising

Sub-processor	Purpose	Location	Transfer safeguard
Google Analytics / Google Ads	Aggregate website analytics and advertising measurement (consent-based).	US.	EU–US Data Privacy Framework; SCCs.
Matomo / Plausible	Privacy-friendly analytics alternative (where configured).	EU where the EU-hosted option is configured.	EU-hosted; SCCs if otherwise.
Sentry	Error and performance monitoring with PII scrubbing.	EU/US.	SCCs; DPF where applicable.
Meta, LinkedIn	Advertising-conversion measurement (consent-based, marketing cookies only).	US.	EU–US Data Privacy Framework; SCCs.

Analytics and advertising sub-processors receive data only where you have consented to the relevant cookie category. Google Analytics is the analytics provider currently in use; the advertising partners (Meta, LinkedIn, Google Ads) and alternative analytics providers are listed because we may engage them, and are active only where an advertising campaign or that provider is configured. Where a US recipient is named with the EU–US Data Privacy Framework as a safeguard, we rely on the Framework only for the period that recipient is actually self-certified under it, and otherwise rely on the Standard Contractual Clauses. See our Cookie Policy.

5. AI features

Sub-processor	Purpose	Location	Transfer safeguard
OpenAI; Anthropic	Large-language-model features (in-product AI tools).	US.	SCCs; contractual no-model-training and zero/limited-retention terms.

Text you submit to the in-product AI tools is sent to these providers under contractual terms that require it to be used only to provide the feature to us, not to train the provider's own models, and to be retained only for the limited period needed for abuse-monitoring or as required by law before deletion.

6. Changes and notification

We may add or replace a sub-processor as the Service evolves. Where you are a customer-controller, we will notify you of an intended addition or replacement of a sub-processor that handles personal data on your behalf at least thirty (30) days in advance, giving you the opportunity to object on reasonable grounds, as described in our Data Processing Addendum. To subscribe to sub-processor change notifications, email privacy@trendskew.com.

7. Contact

Questions about our sub-processors can be sent to privacy@trendskew.com.

Sub-processors