Subprocessor list
Every company that can reach data Popfinch processes for you: what for, which categories, where, and on what transfer basis.
- Version
- 1.0
- Effective
- 3 September 2026
- Last updated
- 3 September 2026
Subprocessors we engage
These are engaged by Vielendark to run the service. You are told before one is added or replaced, with enough notice to object.
| Service | Legal entity | Purpose | Data categories | Primary location | Transfer mechanism |
|---|---|---|---|---|---|
| Vercel | Vercel Inc., United States | Hosts the dashboard, the API and the script that serves widgets. | Request metadata; lead contents and widget configuration in transit. | Serverless functions in Dublin. Edge cache answers from the visitor's region. | Standard contractual clauses. |
| Supabase | Supabase Inc., United States | Database, authentication, image storage. | Accounts, organisations, sites, widgets, leads, statistics, operational email queue. | Ireland (eu-west-1). | Standard contractual clauses for vendor access to EU-hosted data. |
| Anthropic | Anthropic PBC, United States | The AI designer, only for the request in which it is used. | The typed instruction, a summary of the widget, an optional screenshot of your website. No leads. | United States. | Standard contractual clauses. |
| Resend | Resend Inc., United States | Sends transactional and operational email. | Recipient address and the text of the notice. | United States; email may be dispatched from a selected sending region. | EU–US Data Privacy Framework where applicable and standard contractual clauses. |
| Stripe | Stripe Payments Europe Ltd., Ireland | Takes payment for a plan, and holds the card details it is given. | Billing identity, and what the card holder enters on Stripe's page. No customer or visitor data. | Ireland, with group processing in the United States. | Standard contractual clauses. |
Anthropic's commercial API terms state that inputs and outputs are not used to train its models unless the customer opts in, and that API inputs and outputs are deleted from its backend within 30 days by default, subject to safety, legal and separately agreed retention exceptions. Resend states that its Article 28 data processing addendum applies to every account.
Recipients you choose
These receive data only because you switched them on, under your own contract with them. They are recipients you nominate rather than subprocessors we selected, and they are listed here because a reader of this page wants to know where data can end up.
| Service | When it receives anything | What it receives |
|---|---|---|
| Ecomail | When you enable the integration for a widget. | The lead: the fields your form collected, and the consent wording shown. |
| Your webhook | When you configure an endpoint for a widget. | The same lead, signed so you can verify it came from Popfinch. |
How changes are announced
This page carries a version and an effective date. A new or replaced subprocessor raises the version, and account owners are emailed before the change takes effect. If you object on reasonable data protection grounds and no alternative is available, you may end the affected part of the agreement without penalty.