Subprocessors

The complete list of third parties that may process personal data on our behalf, with what they do, where they do it and under what transfer safeguard. This page is Annex III to the Data Processing Agreement and is authoritative.

Version 2.2 Effective 31 July 2026 Next scheduled review: 31 January 2027

Three companies. That is the whole list. plugwith.me runs on a deliberately small stack — a host, a database and a payment provider — because every additional vendor is another contract, another transfer assessment and another thing that can leak. We give 30 days' notice before that list changes, and paid customers can object.

1. Current subprocessors

Subprocessor	What it processes	Data categories	Location	Safeguard	Since
Netlify, Inc. 512 2nd Street, Suite 200 San Francisco, CA 94107, USA Privacy · DPA	Hosting and global content delivery; execution of the edge functions that render link pages and receive click events; rate limiting; derivation of the country code from the IP address; access logs	Visitor connection data (IP, user agent, URL, referrer) transiently and in access logs; all page content	Global edge network. EU points of presence, including Frankfurt and Amsterdam, serve EU visitors. Company established in the USA.	EU–US Data Privacy Framework · EU SCCs · UK Addendum	2025
Supabase, Inc. Delaware, USA · operations in Singapore Privacy · DPA	Managed Postgres holding accounts, link configuration and click events; authentication and session issuance; object storage for uploaded images and invoice PDFs; delivery of authentication emails	Customer account data; link configuration; uploaded images; click events; invoice PDFs	United States — AWS `us-east-2` (Ohio). Support and operations access possible from the USA and Singapore.	EU SCCs (Module 3) · UK Addendum · Swiss annex. Not DPF-certified. Transfer impact assessment: Privacy 7.1	2025
Stripe Payments Europe, Ltd. 1 Grand Canal Street Lower Dublin 2, Ireland with Stripe, Inc., USA Privacy · DPA	Payment processing, subscription management, invoice issuance and tax determination (Stripe Tax). Relates to customer account data only — never to visitor data.	Name, billing address, VAT ID, email, payment instrument, transaction and subscription records	Ireland and the USA	EU–US Data Privacy Framework · EU SCCs · Stripe DPA. Stripe is an independent controller for payment data.	2026

2. Deliberately not on this list

Two categories are often mistaken for subprocessors. Neither is one, and the distinction matters for who you have to contract with.

2.1 Marketing pixel providers

Meta, Google, TikTok and Snap are not our subprocessors. When a customer enables one of their pixels on a link page, the script runs in the visitor's browser and sends data to that provider directly. Nothing passes through our servers, we have no contract with them for it, and we receive nothing back. The customer is the controller for that processing — in some configurations jointly with the provider — and needs their own arrangements. See section 1.3 of the DPA and section 3 of the Cookie Policy.

2.2 Content delivery networks

None. Until July 2026 the Supabase JavaScript client was pulled from the public CDN esm.sh on the signup, login and dashboard pages. That dependency has been removed: the library is now served from our own domain at a pinned version, with its checksum recorded in the repository. No third-party script is loaded anywhere on this service.

2.3 Others

We use no analytics vendor, no CRM, no marketing automation, no email marketing platform, no customer-support platform, no session-recording tool, no AI or machine-learning service, and no third-party moderation service. Support runs over ordinary email; the mailbox provider handles that correspondence, which is our own controller data rather than Customer Personal Data under the DPA.

3. How changes work

We publish the intended change on this page and update the version and effective date.
We notify customers at least 30 days before it takes effect — by email to the account address, and to anyone subscribed in section 4.
Customers may object within 30 days on reasonable data protection grounds, under section 6.3 of the DPA. We will then look for a way to serve you without that subprocessor; if there is none, either party may terminate the affected part of the Service and we refund prepaid fees pro rata.
Where a subprocessor must be replaced immediately for security or continuity reasons, we act first and notify without undue delay, with reasons. The right to object then applies retrospectively.

4. Get notified of changes

Send an email with the subject "Subscribe subprocessors" to info@ponyagcy.com and we will add you to the notification list. Include the account email address you want notices sent to. You can unsubscribe at any time by replying; we keep the address only for this purpose (Article 6(1)(b) and (f) GDPR) and delete it when you unsubscribe or when your account closes.

Notification is not required for you to have the right to object — customers on paid plans are notified at their account address whether or not they subscribe. The list exists so that a compliance mailbox can be notified alongside the account owner.

5. Change history

Date	Change
31 July 2026	Version 2.2. Removed the `esm.sh` dependency — the Supabase browser client is now self-hosted at a pinned version, so no third-party script is loaded on any page of the service.
31 July 2026	Version 2.1. Corrected the Supabase hosting region: the production project runs in the United States (`us-east-2`, Ohio), not in Frankfurt as previously stated. The transfer rests on the EU Standard Contractual Clauses; Supabase is not DPF-certified. Transfer impact assessment: Privacy 7.1.
31 July 2026	Version 2.0. Removed Resend, Inc. — the integration was listed in error and never existed; authentication emails are and always were sent by Supabase. Removed Google Ireland Ltd. — fonts are served from our own domain, so Google never received a request. Clarified that Stripe acts as an independent controller for payment data.
29 May 2026	Version 1.0. Initial list published as part of the DPA summary.