Sub-processors

These are the service providers that process personal data on our behalf. Every one is named, with what we use it for and where it operates. This is the same register our business customers receive under the Data Processing Agreement, and the machine -readable source is at /api/sub-processors.

Controller

Vilkaks UAB, registered company ID 308049358, Klaipėda, Lithuania. Lead supervisory authority: the Lithuanian State Data Protection Inspectorate (VDAI).

Current sub-processors

• Cloudflare, Inc. - edge hosting, WAF, DNS, R2 object storage, Workers AI inference, KV cache. Global edge, EU region preferred where the origin allows.
• Stripe Payments Europe, Ltd. - subscription billing, payment-method storage, invoicing. Ireland (EU).
• Mailgun Technologies, Inc. - transactional email (sign-in, security alerts). United States / EU.
• Telegram FZ-LLC - companion bot and safety-contact alerts, opt-in only. UAE / global.
• IPQualityScore, LLC - IP reputation lookup at sign-in and sign-up. United States.
• Anthropic, PBC - LLM inference for Hearth and admin drafting, where configured. United States.
• Microsoft Ireland Operations, Ltd. (Azure) - LLM inference via Azure OpenAI, where configured. Ireland (Azure West Europe).
• EmailRep.io - email reputation lookup at sign-up. United States.
• Have I Been Pwned - breach-exposure check, queried k-anonymised so the service never learns your address. Global.
• SEON Technologies, Ltd. - fraud and device-risk signals, where configured. EU (Hungary).

Conditional providers

These become sub-processors only if the corresponding delivery channel is switched on, and are added to the register above when that happens. Neither is active by default: wasenderapi.com for WhatsApp delivery, and Resend for additional transactional email.

Transfers outside the EEA

Where a provider above operates outside the European Economic Area, the transfer relies on an adequacy decision where one applies to that provider, and otherwise on the EU Standard Contractual Clauses (Commission Decision 2021/914) together with a transfer impact assessment and supplementary measures. You can ask us for the specific safeguard relied on for any provider through our contact form.

Changes

We give 30 days' notice before adding or replacing a sub-processor - in the dashboard and by email to the administrator on business accounts. Business customers may object in writing on reasonable data-protection grounds within that window; if we cannot resolve the objection, they may terminate the affected service and receive a pro-rata refund.

Last updated: 2026-08-22 · The authoritative register is served at /api/sub-processors; if this page and that endpoint ever disagree, the endpoint is correct and this page is stale - please tell us.