DPA Annex III · Version 2026-10-06
Sub-processors
Last updated: 9 October 2026
This page is the published list required by Art. 28(2) and 28(4) GDPR. It forms Annex III of the Data Processing Agreement.
Processing scope. The first table covers customer analytics sub-processors. The second includes XPmetric account and marketing recipients, customer-initiated integrations and public-data services. This inventory reflects the current code audit. Provider agreements, transfer safeguards and the current hosting location still need confirmation; unconfirmed entries are marked in the tables.
A. Art. 28 sub-processors
| Sub-processor | Purpose | Data | Location | Contract / transfer status |
|---|---|---|---|---|
| Hetzner Online GmbH | App, PostgreSQL, ClickHouse and Redis hosting | Customer analytics and derived records at rest | Germany; TODO(stefan): confirm current datacenter | EU hosting; vendor DPA acceptance pending confirmation |
| Cloudflare, Inc. | CDN, WAF, DDoS and TLS edge for ingest | Visitor IP and HTTP request to analytics endpoints | USA / global edge | TODO(stefan): confirm applicable DPA and transfer safeguards |
| Resend, Inc. (where customer alert/digest email is enabled) | Deliver customer-site alerts and digests | Recipient account email, domain and derived analytics in message body | USA | TODO(stefan): confirm DPA and transfer safeguards |
B. Other recipients and optional integrations
| Recipient | Purpose | Data | Location | Scope / status |
|---|---|---|---|---|
| Stripe Payments Europe / Stripe, Inc. | XPmetric SaaS billing; optional customer Connect revenue | Account email and billing IDs; provider charge/customer metadata for attribution | Ireland / USA | Billing and customer-initiated connection; vendor agreement confirmation pending |
| Polar | Optional customer revenue import | Organization token and provider order/customer data | TODO(stefan): confirm provider location | Customer-initiated connection; vendor agreement confirmation pending |
| Resend, Inc. | Account/auth/billing/lifecycle email | Account email and message body | USA | Controller-side mail; contract confirmation pending; customer analytics mail is in A |
| Google Analytics | Consented analytics on xpmetric.com | Marketing-site pageviews and GA cookies | Ireland / USA | CMP-gated; GA4 Data Processing Terms and console settings pending |
| Google OAuth | Optional Google sign-in | Account email, name and profile image | Ireland / USA | User-initiated sign-in; separate from marketing Analytics |
| Google Analytics APIs | Optional historical GA4 import | Owner OAuth credentials/property IDs and aggregate reports | Ireland / USA | User-initiated read-only integration; separate from marketing Analytics |
| YouTube Data and Analytics APIs | Optional account-level channel reports and video metadata | Channel ID/title, authorized YouTube Analytics reports, video IDs and limited title/availability metadata; no customer-site visitor analytics | Google-operated locations; project-specific location not confirmed | Owner-initiated read-only connection; private pilot. Google review and project configuration are not confirmed. |
| Google favicon service (gstatic) | Proxied onboarding favicons | Domain string; our server IP, no forwarded visitor headers | USA | Server-side proxy, not a browser third-party embed |
| Google Search Console / Bing Webmaster | Explicit local collection of growth evidence | Verified property/public page URLs and search/index observations; GSC queries where returned | Provider-operated APIs | Access token/API key supplied to local collector; no continuous hosted OAuth connector yet |
| Cloudflare Turnstile | Login/contact bot protection | Browser signals/IP to widget; token in server verification | USA / global | XPmetric controller-side security; contract/transfer confirmation pending |
| WhyDoesMySiteSuck | Site health | Customer domain only | TODO(stefan): confirm | Domain-only request; no visitor IP/email forwarded |
| X Corp. | Public mentions of customer domains | Domain search query, handle/name, tweet ID, 280-character excerpt and likes | USA | Public-source integration; transfer/legal-basis review pending; no stored avatar URL |
| ExchangeRate-API | Revenue-display FX rates | Currency codes and service API key | TODO(stefan): confirm if needed | No customer visitor/account personal data sent |
| IndexNow / Microsoft Bing | Public URL notifications | Public URL list | Provider-operated endpoint | No customer visitor/account data sent |
| ProofSwap | Optional marketing testimonial embed | Visitor IP, UA/referrer when loaded | TODO(stefan): confirm | CMP embeds category; no load before user consent |
| GitHub / GHCR | CI and container registry | Source code and public build values | USA | Build-time only, no customer analytics or secret credentials in images |
| Let's Encrypt | Origin TLS certificate issuance | Domain and server IP | Provider-operated certificate authority | Infrastructure metadata, not visitor analytics |
Change notice
The draft DPA proposes at least 30 days' advance notice by email to every affected Customer before adding or replacing a customer-analytics sub-processor. This is a contractual period. You may object in writing during the notice period. Notifications are sent manually and are independent of digest or outreach preferences. If an objection cannot be resolved, the affected services may be terminated as described in the DPA and Terms.