Privacy notice
Last updated: 20 October 2026. This page is a draft pending legal review.
Who we are
subprocessors.fyi is run by [legal entity name], [postal address]. We are the controller of the personal data described here. No company number is stated in this draft.
Contact: privacy@subprocessors.fyi. We have not appointed a data protection officer. EU and UK representative: to be appointed where required.
What we collect
Waitlist and tracker forms store your email, and the tracker form also stores the vendors you name and whether you manage vendors for clients. Question and invoice forms store your name, work email, firm or company when you give it, the message or vendor count, the offer you chose, the page path, and an http or https referrer. We do not store your IP address in these rows.
Inbound email to founders@, alerts@, privacy@, and the catch-all is stored in our database. Payments, once a card link is live, are taken by Stripe on Stripe's pages. We do not see your full card number.
The site uses Cloudflare Web Analytics, which Cloudflare describes as not using cookies or local storage in the browser. We do not set analytics or advertising cookies.
Why we use it
Waitlist and alert signups are on your consent. You can withdraw that consent by emailing privacy@subprocessors.fyi or by using the unsubscribe link in a message we send.
A small number of plain-text emails to published business addresses rely on legitimate interest. The balancing test: the addresses are ones the person published, the messages are few, and every email has an opt-out. After an opt-out, that person's objection outweighs our interest and we stop.
Questions, invoice requests, and paid work are steps toward a contract, or the contract itself.
How long we keep it
Waitlist and alert subscribers are kept until you unsubscribe, plus 30 days. Cold prospects are kept for 12 months at most, or until you opt out. Suppression records are kept indefinitely as hashes so we do not email you again.
Who handles data for us
- Cloudflare hosts the site, stores these rows in D1, routes email, and runs Web Analytics.
- Supabase is a future processor. No personal data from the pages shipping today is sent to Supabase.
- Google, through Gmail, processes the founders mailbox when that mail is read there.
- Stripe will process payments once card links are live. It does not receive page-form data today.
Your rights
You can ask for a copy, a correction, deletion, restriction, or portability, and you can object, including to direct marketing. Email privacy@subprocessors.fyi. You can also complain to the ICO in the UK or to your local authority in the EU.