Subprocessors

The complete list of third parties that may process personal data on our behalf, with what they do, where they do it and under what transfer safeguard. This page is Annex III to the Data Processing Agreement and is authoritative.

Version 2.5 Effective 21 October 2026 Next scheduled review: 31 January 2027

A deliberately short list. plugwith.me runs on a small stack — a host, a database, a payment provider and an email delivery service for our own messages — because every additional vendor is another contract, another transfer assessment and another thing that can leak. Since 21 October 2026 our database, login store and file storage run in the European Union (Frankfurt). We give 30 days' notice before a subprocessor is added or replaced, and customers can object.

1. Current subprocessors

Subprocessor	What it processes	Data categories	Location	Safeguard	Since
Netlify, Inc. 512 2nd Street, Suite 200 San Francisco, CA 94107, USA Privacy · DPA	Hosting and global content delivery; execution of the edge functions that render link pages, receive click events and form submissions and answer API and MCP requests; scheduled jobs that delete expired data and deliver webhooks; rate limiting; derivation of the country code from the IP address; access logs	Visitor connection data (IP, user agent, URL, referrer, browser language) transiently and in access logs; all page content; form submissions and webhook messages in transit	Global edge network. EU points of presence, including Frankfurt and Amsterdam, serve EU visitors. Company established in the USA.	EU–US Data Privacy Framework · EU SCCs · UK Addendum	2025
Supabase Pte. Ltd. 65 Chulia Street #38-02/03, OCBC Centre Singapore 049513 part of the Supabase group with Supabase, Inc., Delaware, USA Privacy · DPA	Managed Postgres holding accounts, team logins, link configuration, click events, form submissions, API keys and webhook settings; authentication and session issuance; object storage for uploaded images, background media and invoice PDFs; delivery of authentication emails	Customer account data; team logins; link configuration; uploaded images; click events; entries visitors send through a customer's form; invoice PDFs	European Union — AWS `eu-central-1` (Frankfurt, Germany), since 21 October 2026. Before that date: United States, AWS `us-east-2` (Ohio). Supabase staff may access the systems for support and operations from outside the EU, including from the USA and Singapore.	Data stored in the EU. For access from outside the EU: EU SCCs (Module 3) · UK Addendum · Swiss annex. We do not rely on the EU–US Data Privacy Framework for Supabase. Transfer impact assessment: Privacy 7.1	2025
Stripe Payments Europe, Ltd. 1 Grand Canal Street Lower Dublin 2, Ireland with Stripe, Inc., USA Privacy · DPA	Payment processing, subscription management, invoice issuance and tax determination (Stripe Tax). Relates to customer account data only — never to visitor data.	Name, billing address, VAT ID, email, payment instrument, transaction and subscription records	Ireland and the USA	EU–US Data Privacy Framework · EU SCCs · Stripe DPA. Stripe is an independent controller for payment data.	2026
Resend, Inc. 2261 Market Street #5039 San Francisco, CA 94114, USA Privacy · DPA From 20 September 2026 for the newsletter, from 30 September 2026 for the erasure confirmation, from 21 October 2026 for cancellation and withdrawal confirmations. The dates are not a formality: see the basis column.	Three purposes, all ours as controller. One: the confirmation email sent to an account holder after their account has been erased on request. Two, from 20 September 2026: the double opt-in confirmation and the welcome message of our own newsletter, to addresses that asked for it. Three, from 21 October 2026: the confirmation the law requires when someone cancels or withdraws from a contract through /cancel or /withdraw (§ 312k(4), § 356a(4) BGB), sent to the address entered in that form, and our internal note about it to our own mailbox. Nothing else — no message of any kind to an address that did not ask, no marketing in any of these messages, and no customer's link or visitor data at any point.	For the erasure confirmation: the account email address and the text of that one message. For the newsletter: the subscriber's address and the message itself. For contract confirmations: the address entered, and the declaration as given — name, plan, type, requested end, reason if one was given, time of receipt, reference. Never link data, click events, visitor events or payment data, and no open or click tracking in either case.	USA	EU SCCs · Resend DPA. Engaged under the notice procedure in DPA § 11.2; announced 30 August 2026, effective 30 September 2026. The newsletter purpose added on 20 September 2026 needs no further notice period: a subscriber is our own contact and not Customer Personal Data, so for that purpose Resend is a processor we engage on our own behalf rather than a subprocessor — DPA § 11.6. The same holds for the contract confirmations added on 21 October 2026: a cancellation or withdrawal concerns the customer's own contract with us, which is our controller data, not data a customer has entrusted to us. It is listed here anyway, because a vendor that handles email for us is one a reader of this page expects to find.	2026

2. Deliberately not on this list

Some categories are often mistaken for subprocessors. None is one, and the distinction matters for who you have to contract with.

2.1 Marketing pixel and embedded player providers

Meta, Google, TikTok and Snap are not our subprocessors. When a customer enables one of their pixels on a link page, the script runs in the visitor's browser and sends data to that provider directly. Nothing passes through our servers, we have no contract with them for it, and we receive nothing back. The same is true of Google (YouTube) and Spotify when a customer embeds a video or a player and the visitor clicks to load it. The customer is the controller for that processing — in some configurations jointly with the provider — and needs their own arrangements. See section 2.3 of the DPA and sections 3 and 4 of the Cookie Policy.

2.2 Content delivery networks

None. Until July 2026 the Supabase JavaScript client was pulled from the public CDN esm.sh on the signup, login and dashboard pages. That dependency has been removed: the library is now served from our own domain at a pinned version, with its checksum recorded in the repository. No third-party script is loaded into any page of this service. A YouTube or Spotify player a customer embeds runs in a separate frame from its provider, and only after the visitor has clicked it (section 2.1).

2.3 Others

We use no analytics vendor, no CRM, no marketing automation platform, no customer-support platform, no session-recording tool, no AI or machine-learning service, and no third-party moderation service. Support runs over ordinary email; the mailbox provider handles that correspondence, which is our own controller data rather than Customer Personal Data under the DPA.

One qualification, added 20 September 2026 so that this paragraph stays true. This section previously said "no email marketing platform". We now send an opt-in newsletter, and Resend, Inc. delivers it — so a delivery API for email does exist, and it is named in the table above. What still does not exist is the thing that phrase was there to rule out: there is no platform that profiles recipients, no behavioural segmentation, no lead scoring, no automation that decides who is sent what, and no open or click tracking of any kind. Our messages fetch nothing when they are opened, so there is no measurement to store. The newsletter list is a list of addresses that asked to be on it, and the only thing recorded about each is the consent behind it.

2.4 Recipients a customer connects

Webhook addresses, systems that call our API and AI assistants connected through our MCP endpoint are chosen by the customer. We deliver the customer's data to them on the customer's instruction; they are the customer's recipients, not our subprocessors (section 2.7 of the DPA).

3. How changes work

We publish the intended change on this page and update the version and effective date.
We notify customers at least 30 days before it takes effect — by email to the account address, and to anyone subscribed in section 4.
Customers may object within 30 days on reasonable data protection grounds, under section 11.3 of the DPA. We will then look for a way to serve you without that subprocessor; if there is none, either party may terminate the affected part of the Service and we refund prepaid fees pro rata.
Where a subprocessor must be replaced immediately for security or continuity reasons, we act first and notify without undue delay, with reasons. The right to object then applies retrospectively.
A change of the region where an existing subprocessor stores the data is announced here too. A move out of the European Economic Area follows steps 1 to 3 in full; a move into or within it is notified before it takes effect, without a waiting period, because it can only improve the customer's position (section 14.7 of the DPA).

4. Get notified of changes

Send an email with the subject "Subscribe subprocessors" to info@plugwith.me and we will add you to the notification list. Include the account email address you want notices sent to. You can unsubscribe at any time by replying; we keep the address only for this purpose (Article 6(1)(b) and (f) GDPR) and delete it when you unsubscribe or when your account closes.

Notification is not required for you to have the right to object — customers on paid plans are notified at their account address whether or not they subscribe. The list exists so that a compliance mailbox can be notified alongside the account owner.

5. Change history

Date	Change
21 October 2026	Version 2.5. Supabase moved to the EU. The production database, authentication store and file storage now run in AWS `eu-central-1` (Frankfurt, Germany) instead of `us-east-2` (Ohio, USA); the former US project is deleted once the move has been verified, and in any event by 20 November 2026. Same provider, new project — no subprocessor was added or replaced, so no 30-day objection period runs; customers were notified before the move (DPA § 14.7). The entry now names Supabase's contracting entity as it appears in Supabase's current terms (Supabase Pte. Ltd., Singapore, part of the group with Supabase, Inc.) and states what remains outside the EU: support and operations access by Supabase staff, covered by the Standard Contractual Clauses. The Netlify and Supabase entries also name the form submissions, API requests and webhook deliveries they now handle — wider use of two existing subprocessors, not a new one. Section 2 now names embedded-player providers and the recipients a customer connects, neither of which is a subprocessor. Two cross-references to the DPA corrected (§ 2.3, § 11.3). Resend, Inc. also delivers, from the same date, the confirmations of cancellations and withdrawals sent through /cancel and /withdraw and our internal note about them — a third purpose of our own as controller, not Customer Personal Data, so no notice period runs (DPA § 11.6).
20 September 2026	Version 2.4. Widened the Resend, Inc. entry to name the second purpose it now serves: our own opt-in newsletter, live from this date. Corrected section 2.3, which said "no email marketing platform" — a delivery API for email now exists and is named in the table; what does not exist is any profiling, segmentation, automation or open/click tracking, which is what that phrase was there to rule out. No new notice period runs — a newsletter subscriber is our own contact rather than Customer Personal Data, so for that purpose Resend is a processor engaged on our own behalf and not a subprocessor under DPA § 11.6. No customer data reaches it for this purpose, and the previous entry's claim that Resend carried "no newsletters" was corrected rather than left standing against the product.
30 August 2026	Version 2.3. Added Resend, Inc. as a subprocessor for one purpose only: delivering the confirmation email that follows an account erasure. Announced 30 August 2026 under DPA § 11.2 and effective 30 September 2026, so the 30 days' notice and the right to object run in full before any message is sent through it.
31 July 2026	Version 2.2. Removed the `esm.sh` dependency — the Supabase browser client is now self-hosted at a pinned version, so no third-party script is loaded on any page of the service.
31 July 2026	Version 2.1. Corrected the Supabase hosting region: the production project runs in the United States (`us-east-2`, Ohio), not in Frankfurt as previously stated. The transfer rests on the EU Standard Contractual Clauses; Supabase is not DPF-certified. Transfer impact assessment: Privacy 7.1.
31 July 2026	Version 2.0. Removed Resend, Inc. — the integration was listed in error and never existed; authentication emails are and always were sent by Supabase. Removed Google Ireland Ltd. — fonts are served from our own domain, so Google never received a request. Clarified that Stripe acts as an independent controller for payment data.
29 May 2026	Version 1.0. Initial list published as part of the DPA summary.