Legal

Subprocessors and service providers

Last updated August 24, 2026.

Overview

This page lists entities that help OptinStack deliver the Service. It distinguishes Customer Data Subprocessors (engaged when we process Customer Personal Data as your processor under our Data Processing Agreement) from other service providers and independent controllers (for example account authentication, product analytics, and Merchant of Record billing).

Each catalog entry includes: third-party entity, service provided, data categories, corporate location, hosting location, transfer mechanism, optionality, contacts (including privacy contact where published), effective date, and applicable services. “Service provided” describes the vendor’s general role for OptinStack, not OptinStack’s internal system design or data-flow architecture.

Customer Data Subprocessors on this page are incorporated into the DPA as Transfer Annex III by reference.

Questions about this list: OptinStack hello@optinstack.com.

Customer Data Subprocessors

These entities process Customer Personal Data on behalf of OptinStack as processor under our Data Processing Agreement (Annex III).

Cloudflare, Inc.

Service provided: Cloud infrastructure
Data categories: Consent records, account and configuration data, operational logs, and related Service data needed to host and deliver the platform
Corporate location: United States
Hosting location: Global network
Transfer mechanism: EU SCCs Module 2 / UK Addendum as applicable; provider transfer terms
Optionality: Required for the Service
Contacts / privacy: https://www.cloudflare.com/privacypolicy/
Effective date: 2026-08-08
Applicable services: OptinStack Service

OpenAI OpCo, LLC

Service provided: AI features
Data categories: Limited tracker metadata, public-page observations, and styling context you submit when requesting AI-assisted features (not visitor consent records, raw IP addresses, payment data, or credentials)
Corporate location: United States
Hosting location: United States
Transfer mechanism: EU SCCs Module 2 / UK Addendum as applicable; provider transfer terms
Optionality: Optional: engaged only when you use AI-assisted features
Contacts / privacy: https://openai.com/policies/privacy-policy/
Effective date: 2026-08-08
Applicable services: AI-assisted features

Google LLC (Cloud Translation)

Service provided: Machine translation
Data categories: Banner and preferences text you choose to translate (not visitor consent records, raw IP addresses, payment data, or credentials)
Corporate location: United States
Hosting location: Provider regions
Transfer mechanism: EU SCCs Module 2 / UK Addendum as applicable; provider transfer terms
Optionality: Optional: engaged only when you use translation features
Contacts / privacy: https://cloud.google.com/terms/cloud-privacy-notice
Effective date: 2026-08-08
Applicable services: Translation features

Other Service Providers and Independent Controllers

These entities support OptinStack account operations, product analytics, or self-serve billing. They process data as independent controllers or as service providers when OptinStack acts as controller. They are not Customer Data Subprocessors for your website visitors’ consent records under the DPA.

Clerk, Inc.

Service provided: Authentication services
Data categories: Account holder email, authentication identifiers, and role metadata
Corporate location: United States
Hosting location: United States
Transfer mechanism: Provider controller / service-provider terms; SCCs where the provider applies them
Optionality: Required for OptinStack account authentication
Contacts / privacy: https://clerk.com/legal/privacy
Effective date: 2026-08-08
Applicable services: Account authentication and workspace access

PostHog, Inc.

Service provided: Product analytics
Data categories: Customer product events, diagnostics, and aggregated consent counts (not visitor-level consent events or salted visitor hashes)
Corporate location: United States
Hosting location: United States
Transfer mechanism: Provider controller / service-provider terms; SCCs where the provider applies them
Optionality: Used for OptinStack product analytics
Contacts / privacy: https://posthog.com/privacy
Effective date: 2026-08-08
Applicable services: OptinStack Service

Paddle.com Market Limited

Service provided: Merchant of Record and authorized reseller
Data categories: Buyer name, email, billing address, and payment card data for the purchase transaction (held by Paddle as independent controller)
Corporate location: United Kingdom
Hosting location: United States / provider regions
Transfer mechanism: Independent controller; Paddle privacy and commercial terms apply to buyer data
Optionality: Required for self-serve paid checkout
Contacts / privacy: https://www.paddle.com/legal/privacy
Effective date: 2026-08-08
Applicable services: Paid services

Things to Know

Which Customer Data Subprocessors apply to you depends on the OptinStack Services and optional features you use (for example AI-assisted features or translations).

Under general written authorization in the DPA, OptinStack will inform customers of intended additions or replacements of Customer Data Subprocessors at least thirty (30) days before engagement, by updating this list and, where we have a working account email, by email. You may object on reasonable data-protection grounds before engagement as described in the DPA.