Sub-processors

We process customer data with the help of a small set of third-party services, each bound by a Data Processing Agreement under GDPR Art. 28. The list below is exhaustive as to sub-processors - we add nothing else without updating this page first. Two further recipients act as independent controllers rather than our processors, and so are not Art. 28 sub-processors: Google, if you choose to sign in with Google, and any farm you contact through a sale or breeder page. Both are described in our Privacy policy.

1. Active sub-processors

These providers process customer data today.

Supabase Inc.

Role: Database, authentication, and file storage
Region: Frankfurt, Germany (EU)
Transfer: Customer data is stored and processed in the EEA (eu-central-1, Frankfurt). Because Supabase Inc. is US-incorporated, its Data Processing Agreement and the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) remain the safeguard for any incidental access by the US parent.
Data Processing Agreement ↗

Vercel Inc.

Role: Application hosting, CDN, and Web Analytics
Region: Edge functions pinned to fra1 (Frankfurt)
Transfer: Web Analytics operates in cookieless mode (no device storage; visitor identification via server-side request hash, discarded after 24 h). Some platform telemetry processed in the United States under EU Standard Contractual Clauses.
Data Processing Agreement ↗

Cloudflare Inc.

Role: DNS resolution for alpacakeep.com
Region: Global anycast network
Transfer: No application data is stored; only DNS queries for alpacakeep.com are processed. Queries resolve at the nearest Cloudflare point of presence, which may be outside the EEA, so the Cloudflare Data Processing Addendum and the EU Standard Contractual Clauses (Decision (EU) 2021/914) apply. We do not use Cloudflare to proxy, cache or inspect HTTP traffic.
Data Processing Agreement ↗

Heinlein Hosting GmbH (Mailbox.org)

Role: Email hosting for @alpacakeep.com mailboxes
Region: Berlin, Germany (EU)
Transfer: No transfer outside the EEA via this processor.
Data Processing Agreement ↗

Umami Software, Inc.

Role: Privacy-friendly website analytics for the public marketing pages only (the signed-in app is not tracked)
Region: European Union (Umami Cloud EU data region, Germany)
Transfer: Cookieless: no cookies, no device storage, and no IP address is stored. The visitor’s IP and user-agent are processed transiently to count anonymous visits, then discarded. The account’s data region is set to the EU, so analytics data is stored in the European Union. No transfer outside the EEA via this processor.
Data Processing Agreement ↗

2. Planned sub-processors

These providers are not yet active. They will move to Section 1 before they begin processing customer data.

Sentry - error tracking (planned for Phase B; EU cluster).
Axiom - structured application logs (planned for Phase B).
Better Uptime - health checks for the public status page (planned for Phase B).
Stripe - SaaS billing (planned for Phase C, when paid plans launch).
Resend - transactional email (planned for Phase C).

3. Notification of changes

We update this page before any new sub-processor begins processing customer data, and we notify customers with active accounts by email at least 30 days before the change takes effect. If you object to a new sub-processor within that period, write to privacy@alpacakeep.com and we will look for an alternative; where none is reasonably available you may terminate your subscription for the affected service and receive a pro-rata refund of any prepaid fees.