Subprocessor Register
Who receives personal data because of something you do with us, which of them act on our instruction, and what changed and when.
Effective
Summary
16 recipients: 13 process personal data on our instruction and 3 receive it for their own purposes. The same list is section 04 of the Privacy Policy; this page adds the legal entities, transfer bases and the change log.
01
What this register is
A subprocessor processes personal data on our documented instruction so that we can deliver something you asked for. When we process personal data for your organisation, section 14 of the Terms of Service authorises the providers listed here, and this page is where an addition is announced.
Published by Michal Jatczak, trading as ITSailor, a sole trader registered in Malta, VAT MT32760411, Level 1, Unit 60, Door No 63, Connecticlub Business Center, Triq Il-Ballut (Zona Industrijali, Mosta), MST 4001, Mosta, Malta. It is a transparency notice; where a signed agreement with you says something different, the signed agreement governs.
02
Subprocessors we instruct
Where data leaves the EEA we rely on the European Commission Standard Contractual Clauses (Decision (EU) 2021/914) and, where the recipient is certified, the EU-US Data Privacy Framework (Decision (EU) 2023/1795). Rows that name a service rather than a company have not had their contracting entity verified; ask us and we tell you which entity we contract with.
| Recipient | What it does with the data | Established in | Processing location | Transfer basis |
|---|---|---|---|---|
| Stripe Payments Europe Ltd. | Payments. Stripe is also an independent controller for its own fraud prevention, financial risk, AML and KYC obligations and product development | Ireland (EEA) | Ireland, inside the EEA, with routing to Stripe group entities outside the EEA | Standard Contractual Clauses (EU) 2021/914 for any routing outside the EEA; Stripe also self-certifies under the EU-US Data Privacy Framework. |
| Microsoft Ireland Operations Limited (Microsoft 365) | Our business email and files | Ireland (EEA) | Inside the EEA: our Microsoft 365 tenant is in the EU region | Standard Contractual Clauses (EU) 2021/914 in Microsoft's Products and Services Data Protection Addendum, for any processing outside the EEA. |
| Hetzner Online GmbH | Our servers, databases and backups, including the automation server that runs managed automation packages | Germany (EEA) | Germany, inside the EEA | None needed. The processing does not leave the EEA. |
| Vercel, Inc. | Website hosting, and analytics only if you accept it; the analytics is cookie-free and not used for advertising or cross-site profiling. Vercel is also an independent controller for the usage data its service generates | United States | Functions run in Frankfurt, Germany, inside the EEA. Static assets and request logs are served from a global edge network, and analytics is processed mainly in the United States, both outside the EEA | Standard Contractual Clauses (EU) 2021/914 in Vercel's Data Processing Addendum: Module Two for what we instruct, Module One for the usage data Vercel controls. Vercel also self-certifies under the EU-US Data Privacy Framework. |
| Cloudflare, Inc. | DNS and a secure tunnel to our servers | United States | A global edge network outside the EEA; EU traffic is served from EU edge nodes | EU-US Data Privacy Framework, with the Standard Contractual Clauses (EU) 2021/914 in place regardless. |
| Resend (Plus Five Five, Inc.) | Sending email: our own, and the email our managed automation packages send for a client | United States | United States, outside the EEA | EU-US Data Privacy Framework, with the Standard Contractual Clauses (EU) 2021/914 in place regardless. |
| Upstash, Inc. | Tool and security data: rate limits, sign-in state, scan results for up to 10 minutes, and Tenant Security Scorecard trend scores for up to 180 days | United States | Ireland (AWS eu-west-1), inside the EEA | Data processing addendum and the Standard Contractual Clauses (EU) 2021/914, for access by Upstash, Inc. from outside the EEA. No framework listing is claimed. |
| GitHub, Inc. | Private repositories for client deliverables | United States | United States, outside the EEA | EU-US Data Privacy Framework, self-certified under the Microsoft umbrella, with the Standard Contractual Clauses (EU) 2021/914 in place regardless. |
| OpenAI (API) | Writing free-tool reports. API inputs are not used to train models | Not verified. This row names the service rather than a contracting entity; ask us and we will tell you which entity we contract with | Outside the EEA | Standard Contractual Clauses (EU) 2021/914 alone. No framework listing is claimed, because none has been verified. |
| Anthropic (Claude API) | SaaS Auditor briefs from aggregate figures, and contract extraction when you upload a contract. API inputs are not used to train models | Not verified. This row names the service rather than a contracting entity; ask us and we will tell you which entity we contract with | Outside the EEA | Standard Contractual Clauses (EU) 2021/914 alone. No framework listing is claimed, because none has been verified. |
| Mistral AI | AI steps in the managed automation packages, on its EU endpoint. Mistral is also an independent controller for the abuse monitoring its terms provide for | France (EEA) | Data centres in the EU and EFTA behind its EU endpoint: inside the EEA, or in Switzerland under an adequacy decision. Account and billing data may be handled outside the EEA | The Standard Contractual Clauses (EU) 2021/914 in Mistral's Data Processing Addendum, where its own sub-processors work outside the EEA. None is needed for AI calls processed inside the EEA, and Switzerland is covered by the Commission's adequacy decision. |
| Cal.com | Booking calls and workshop sessions | Not verified. This row names the service rather than a contracting entity; ask us and we will tell you which entity we contract with | Outside the EEA | Standard Contractual Clauses (EU) 2021/914 alone. No framework listing is claimed, because none has been verified. |
| DocRaptor | Producing eBook PDFs, which carry the buyer's email in the licence line | Not verified. This row names the service rather than a contracting entity; ask us and we will tell you which entity we contract with | Outside the EEA | Standard Contractual Clauses (EU) 2021/914 alone. No framework listing is claimed, because none has been verified. |
03
Recipients we do not instruct
These parties receive personal data because of something you do with us, but they do not process it on our instruction, so they are not our subprocessors. Stripe, listed above, also uses payment data for its own purposes under its own privacy policy.
| Recipient | What it does with the data | Established in | Processing location | Transfer basis |
|---|---|---|---|---|
| Microsoft Ireland Operations Limited (licences) | Not our sub-processor. Licensor of the Microsoft licences you buy through us; it processes your tenant content as your provider, under its agreement with you | Ireland (EEA) | Your own tenant, under the agreement you hold with Microsoft. The contracting entity is inside the EEA | Not ours to state. Microsoft processes tenant content on your instruction under its Data Protection Addendum with you, so your agreement governs that transfer and not ours. |
| Pax8, Inc. | Not our sub-processor. Our distributor; it receives licence order details to fulfil your order, under its own terms. Your tenant data does not reach it | United States | United States, outside the EEA | Standard Contractual Clauses (EU) 2021/914 in the Pax8 partner agreement. Pax8 receives the order data as an independent controller. |
| Telegram Messenger Inc. | Not our sub-processor. Messaging service that carries alerts and approval notices from our managed automation packages to the staff accounts that asked for them, and to us, under its own terms. It receives no personal data of a client's customers: a message carries a reference, a count or a status and a link to our own server | Outside the EEA; Telegram's privacy policy does not say where. Its representative in the EU is EDPO in Brussels | Data centres in the Netherlands for accounts registered in the EEA, inside the EEA, run by Telegram from outside the EEA | Not ours to state for the recipient's own account, which the recipient holds with Telegram under its terms. Telegram offers no transfer safeguard to its users, so we send it nothing that would need one. |
04
Notice and objection
We give customers at least 30 days' notice by email before a new subprocessor begins processing their personal data. To object, write to privacy@itsailor.io during the notice period with your grounds. If we cannot meet the objection, you may end the affected service.
The change log below is the second channel, for a reviewer who would rather watch a URL: the change log anchor is stable.
05
Change log
Newest first. The list above is current as at . The record starts on 2026-08-02; earlier changes were made in the Privacy Policy without a dated record.
| Date | Kind | What changed |
|---|---|---|
| correction | Pax8: the entity that invoices our licence orders is Pax8, Inc. in the United States; the register had shown it as established in the Netherlands. Its transfer basis is the Standard Contractual Clauses in our partner agreement. Upstash: the former newsletter list and its consent records were deleted, so Upstash no longer holds them. Pax8 remains a recipient we do not instruct. No recipient was added or removed. | |
| addition | Mistral AI added as a subprocessor for the AI steps of our managed automation packages, on its EU endpoint; it is also an independent controller for the abuse monitoring its terms provide for. Telegram added as a recipient we do not instruct: it carries alerts and approval notices to staff accounts and to us, and receives no personal data of a client's customers. Hetzner now also hosts the automation server, and Resend also sends the email the packages send for a client. No client data had been processed by the packages when this was published, and no existing customer's processing changed, so no notice period applied. Services a package reaches with a client's own account, such as WhatsApp Business, Shopify, Google or a client's own Cal.com, are the client's providers and are not listed. | |
| correction | Resend: the contracting entity is Plus Five Five, Inc. in San Francisco, the data importer named in Resend's Data Processing Agreement. No recipient was added or removed by this correction. | |
| removal | Google (reCAPTCHA) removed. The contact form no longer loads reCAPTCHA, so Google receives no data from it and sets no cookie. Spam is stopped on our own server by a rate limit, a hidden field and a minimum fill time. No recipient was added. | |
| correction | Upstash: the database runs in AWS Ireland (eu-west-1), inside the EEA, and the register had said the United States. The contracting entity is Upstash, Inc. in the United States, so the Standard Contractual Clauses stay for its access. No recipient was added or removed. | |
| removal | Plausible Insights OÜ removed: website analytics moved to Vercel Web Analytics. Vercel, Inc., already our hosting provider, now also processes analytics data, only for visitors who accept analytics, mainly in the United States. Its row now also records that Vercel is an independent controller for the usage data its service generates, which its Data Processing Addendum already provided for hosting. No new recipient was engaged, and the consent banner asks every visitor again. | |
| correction | Microsoft 365 added as the processor of our business email and files; it has been our email provider throughout and the register had omitted it. Google (reCAPTCHA) moved from the recipients we do not instruct to the subprocessors, because Google processes reCAPTCHA data as the site owner's processor since 2 April 2026; reCAPTCHA now runs on the contact form only. Upstash no longer holds newsletter consent records, only the former list until it is deleted. Cal.com no longer books product demos and GitHub no longer authenticates a tool, because both features left the site on 2026-10-08. | |
| publication | This register published at its own URL. No recipient was added or removed. The role of each recipient was recorded explicitly: Google (reCAPTCHA), Microsoft Ireland and Pax8 were listed as recipients we do not instruct, and Stripe as holding both roles at once. | |
| correction | The list on the Trust Center was reconciled with the Privacy Policy. An attribution of Azure infrastructure for AI features to Microsoft Ireland was deleted as false: no Azure-hosted model client exists in the platform. | |
| addition | Anthropic (Claude API), OpenAI (API), Cal.com, DocRaptor and Google (reCAPTCHA) added to the Privacy Policy. Four of the five were already receiving data, so the entry records a disclosure being corrected, not a new recipient being engaged. |
06
Contact
Questions about a recipient, a transfer basis, a copy of the Standard Contractual Clauses or a data subject request: privacy@itsailor.io. Contracts: legal@itsailor.io.
Michal Jatczak, trading as ITSailor, Level 1, Unit 60, Door No 63, Connecticlub Business Center, Triq Il-Ballut (Zona Industrijali, Mosta), MST 4001, Mosta, Malta.