Overview
OptinStack ("we", "us") engages the following sub-processors to deliver, secure, and support the Service. This list supports our Data Processing Agreement and our customers' procurement and due-diligence reviews.
We provide at least 30 days notice of material changes by email to account owners and by updating this page. To object to a new or replacement sub-processor before a change takes effect, contact us at the address below with your workspace details.
Sub-processor questions or objections: hello@optinstack.com.
Infrastructure and storage
These providers host, store, and route the personal data that runs the Service:
- Cloudflare, Inc., hosting, CDN, edge compute, object and key-value storage, databases, queues, and operational analytics. Data: customer configuration, consent records, account identifiers, public scan inputs, and service logs. Region: global, including the United States; no region pinning by default. Transfer safeguard where required: SCCs and applicable adaptations. Required. Privacy: https://www.cloudflare.com/privacypolicy/. Effective: 2026-07-11.
Identity and authentication
Providers that authenticate customers and manage sessions:
- Clerk, Inc., customer authentication, identity, and session management. Data: email address, authentication identifiers, role metadata, session and security data. Region: United States. Transfer safeguard where required: SCCs. Required for account access. Privacy: https://clerk.com/legal/privacy. Effective: 2026-07-11.
Payments
Providers that handle billing and payment:
- Paddle.com Market Limited. Merchant of Record, checkout, tax, invoicing, payment, and refund processing. Data: buyer name, email, billing address, transaction and payment data; card details are held by Paddle, not OptinStack. Regions: United Kingdom and Paddle service regions. Transfer safeguard where required: adequacy decisions and contractual safeguards. Required only for paid purchases. Privacy: https://www.paddle.com/legal/privacy. Effective: 2026-07-11.
Product analytics and monitoring
Providers that help us understand usage and detect errors:
- PostHog, Inc., product analytics and error monitoring for the operated OptinStack platform (dashboard and server-side product events), including aggregated consent event counts. Data: product events, account or project identifiers, diagnostics, and salted end-user hashes; never raw end-user IP addresses in consent analytics. Region: United States. Transfer safeguard where required: SCCs. Used for operated product analytics; the public marketing, docs, and community sites do not load the PostHog browser SDK. Privacy: https://posthog.com/privacy. Effective: 2026-07-12.
Optional AI-assisted classification
This sub-processor is engaged only when a customer actively chooses to use it.
- Anthropic, PBC (Claude): optional AI-assisted tracker classification and banner design on entitled plans. Data: tracker metadata or styling context actively submitted by an editor; no visitor consent records, raw IP addresses, payment data, or credentials. Region: United States. Transfer safeguard where required: SCCs. Optional. Privacy: https://www.anthropic.com/legal/privacy. Effective: 2026-07-11. Suggestions require editor review.
- Google LLC (Cloud Translation): optional banner and preferences translation on entitled plans. Data: text selected for translation; no visitor consent records, raw IP addresses, payment data, or credentials. Regions: Google Cloud service regions. Transfer safeguard where required: SCCs and Google Cloud data-processing terms. Optional. Privacy: https://cloud.google.com/terms/cloud-privacy-notice. Effective: 2026-07-11.
Changes to this list
We update this list when we add, replace, or remove a sub-processor. Material changes are posted here with a revised "Last updated" date and, where required by law, notified to account owners.