Infrastructure
| Company | What it does | Data | Location |
|---|---|---|---|
| Dedicated server provider in Switzerland | Servers that run Polymorfa and store its databases and files | All customer and account data that Polymorfa stores | Switzerland |
| Cloudflare, Inc. | Network edge: DNS, encrypted connection termination, DDoS protection and access control for staff tools | All traffic in transit, including IP addresses. Nothing is stored beyond short-lived logs. | United States; global edge network |
Communication and support
| Company | What it does | Data | Location |
|---|---|---|---|
| Resend | Sends account, billing and notification emails, and receives support email | Name, email address, email content | United States |
| Hetzner Online GmbH | Hosts our support desk | Support conversations, attachments and contact details | Germany |
| Linear | Tracks bugs and feature requests raised through support | Support request content and the reporting team | United States |
| Slack Technologies, LLC | Shared support channels for customers with Enhanced support; internal operational alerts | Messages exchanged in the channel; team and project identifiers in alerts | United States |
Analytics and product
| Company | What it does | Data | Location |
|---|---|---|---|
| PostHog, Inc. | Website and console analytics and masked session replay, only in your browser and only after you consent; gradual feature rollout. Our servers send it no product analytics. | Pages and features used and device data. When you are signed in: your user ID, email, name and username, and your team's ID, name, slug, status and feature groups. Feature rollout uses team identifiers only. | United States |
| Google LLC | Connection setup for calls placed in the browser | IP address and port of the browser | United States |
Not subprocessors
These companies receive personal data but decide for themselves how to use it, under their own terms and privacy policies:
- Paddle.com (United Kingdom), our merchant of record, for payments, invoices and tax.
- WhatsApp LLC and Meta Platforms, which carry every WhatsApp message and call.
- Google, GitHub, GitLab and Bitbucket, only if you choose to sign in with them.
- Storage providers or other services that a customer connects to its own team, such as its own S3 bucket. The customer chooses and contracts with them.
Changes to this list
If a customer agrees regional storage in Brazil or India, the hosting provider for that region joins this list before it receives any data.
We email the owners of every team at least 30 days before a new subprocessor starts processing customer data. You can object on reasonable data protection grounds as the DPA describes. In an emergency, such as replacing a provider that has failed, we may give shorter notice and will explain why.
Questions: privacy@polymorfa.com.