Infrastructure
| Company | What it does | Data | Location |
|---|---|---|---|
| Hetzner Online GmbH | Dedicated servers, object storage and backups that run Polymorfa and store its databases and files; also hosts our support desk | All customer and account data that Polymorfa stores, and support conversations | Germany (Falkenstein, Nuremberg); backups in Finland (Helsinki) |
| Cloudflare, Inc. | Network edge: DNS, encrypted connection termination, DDoS protection and access control for staff tools | All traffic in transit, including IP addresses. Nothing is stored beyond short-lived logs. | United States; global edge network |
Communication and support
| Company | What it does | Data | Location |
|---|---|---|---|
| Plus Five Five, Inc. (Resend) | Sends account, billing and notification emails, and receives support email | Name, email address, email content | United States |
| Linear Orbit, Inc. (Linear) | Tracks bugs and feature requests raised through support | Support request content and the reporting team | United States |
| Slack Technologies Limited (Slack, part of Salesforce) | Shared support channels for customers with Enhanced support; internal operational alerts | Messages exchanged in the channel; team and project identifiers in alerts | Ireland (contracting entity); processing in the United States |
Analytics and product
| Company | What it does | Data | Location |
|---|---|---|---|
| PostHog, Inc. | Website and console analytics and masked session replay, only in your browser and only after you consent; gradual feature rollout. Our servers send it no product analytics. | Pages and features used and device data. When you are signed in: your user ID, email, name and username, and your team's ID, name, slug, status and feature groups. Feature rollout uses team identifiers only. | United States |
Payment providers
Stripe receives name, verified email, billing address, payment details and transaction information to process payments and billing. Its data-processing role depends on the activity and applicable agreement. Its Privacy Policy and Data Processing Agreement describe those roles and the relevant Stripe entity.
For purchases previously processed by Paddle, its Privacy Policy describes how it handles that payment information.
Not subprocessors
These companies receive personal data but decide for themselves how to use it, under their own terms and privacy policies:
- WhatsApp LLC and Meta Platforms, which carry every WhatsApp message and call.
- Google, GitHub, GitLab and Bitbucket, only if you choose to sign in with them.
- Google LLC (United States), when you place a call in the browser: your browser asks Google's public connection service (STUN) for its public IP address and port, so Google receives them.
- Storage providers or other services that a customer connects to its own team, such as its own S3 bucket. The customer chooses and contracts with them.
Changes to this list
Before a number uses our Brazil messaging region, or a customer agrees Swiss storage, the hosting provider for that country joins this list, with the notice below, before it receives any data.
We email the owners of every team at least 30 days before a new subprocessor starts processing customer data. You can object on reasonable data protection grounds as the DPA describes. In an emergency, such as replacing a provider that has failed, we may give shorter notice and will explain why.
Questions: privacy@polymorfa.com.