A "sub-processor" is any third party that processes personal data on our behalf to help us run the Service. Each one operates under a written contract that mirrors the obligations we owe you under the Data Processing Agreement and the Privacy Policy.
Below is the current list. We update this page at least 14 days before adding or replacing a sub-processor — see the notification clause in our DPA.
Active sub-processors
| Provider | Service | Where data is processed | Customer data handled |
|---|---|---|---|
| Stripe, Inc. | Payment processing for platform subscriptions and Invoices app payment links | United States (with EU/UK sub-processors per Stripe's own DPA) | Billing identifiers, payment method tokens, charge amounts, invoice metadata. Card numbers and CVCs never touch our servers — they go directly to Stripe. |
| Hostinger International Ltd. | Application hosting and outbound SMTP relay (smtp.hostinger.com) | European Union and United States data centres | All hosted application data while at rest; outbound email message bodies and addresses while in transit. |
| Cloudflare, Inc. (Turnstile) | Bot-challenge verification on /register | Edge network worldwide; Cloudflare states no personal data is retained beyond the verification verdict | IP address and browser metadata of the registering user, for the duration of the challenge only. |
Functional Software, Inc. dba Sentry (active only when the operator configures SENTRY_DSN) | Application error tracking | United States and Germany | Stack traces, request metadata, the authenticated user id when an error occurs. Payload bodies are scrubbed before being sent. |
How we choose sub-processors
Before we add a sub-processor we check that they:
- Publish a current SOC 2 Type II report, ISO 27001 certification, or an equivalent independent attestation.
- Sign a written data-processing agreement aligned with GDPR Article 28 and the Standard Contractual Clauses where personal data leaves the EEA/UK.
- Document their own sub-processors and notification practice.
Notifications of changes
You can subscribe to sub-processor change announcements at sub-processors@zendrhax.com. Subscribers receive an email with at least 14 days' notice before any addition or replacement, allowing time to object under our DPA.
What if I object to a sub-processor
Under the DPA, if you object in writing within the notice period and we cannot agree on a resolution, you may terminate the affected portion of the Service and receive a pro-rated refund of any prepaid fees for the unused remainder of the term.
Historical changes
| Date | Change |
|---|---|
| Initial publication | Stripe, Hostinger, Cloudflare Turnstile, and Sentry registered as sub-processors. |
We will append a line here every time the active list changes.
Contact
- Sub-processor questions and objection notices — legal@zendrhax.com
- Privacy questions — privacy@zendrhax.com