Subprocessor list
Every company that can reach data Popfinch processes for you: what for, which categories, where, and on what transfer basis.
- Version
- 0.2
- Effective
- 2 September 2026
- Last updated
- 2 September 2026
Subprocessors we engage
These are engaged by Vielendark to run the service. You are told before one is added or replaced, with enough notice to object.
| Service | Legal entity | Purpose | Data categories | Primary location | Transfer mechanism |
|---|---|---|---|---|---|
| Vercel | Vercel Inc., United States | Hosts the dashboard, the API and the script that serves widgets. | Request metadata; lead contents and widget configuration in transit. | Serverless functions in Dublin. Edge cache answers from the visitor's region. | Standard contractual clauses. |
| Supabase | Supabase Inc., United States | Database, authentication, image storage. | Accounts, organisations, sites, widgets, leads, statistics, operational email queue. | Ireland (eu-west-1). | Standard contractual clauses for vendor access to EU-hosted data. |
| Anthropic | Anthropic PBC, United States | The AI designer, only for the request in which it is used. | The typed instruction, a summary of the widget, an optional screenshot of your website. No leads. | United States. | Standard contractual clauses. |
| Google Workspace | Google Ireland Ltd., Ireland | Sends operational email. | Recipient address and the text of the notice. | European Union. | Not applicable within the EEA. |
| Stripe | Stripe Payments Europe Ltd., Ireland | Takes payment for a plan, and holds the card details it is given. | Billing identity, and what the card holder enters on Stripe's page. No customer or visitor data. | Ireland, with group processing in the United States. | Standard contractual clauses. |
To be settled. Owner verification outstanding: the contracting entity and plan on each account above, whether a data processing agreement has been executed with each, and the Anthropic account terms regarding training and retention.
Recipients you choose
These receive data only because you switched them on, under your own contract with them. They are recipients you nominate rather than subprocessors we selected, and they are listed here because a reader of this page wants to know where data can end up.
| Service | When it receives anything | What it receives |
|---|---|---|
| Ecomail | When you enable the integration for a widget. | The lead: the fields your form collected, and the consent wording shown. |
| Your webhook | When you configure an endpoint for a widget. | The same lead, signed so you can verify it came from Popfinch. |
How changes are announced
This page carries a version and an effective date. A new or replaced subprocessor raises the version, and account owners are emailed before the change takes effect. If you object on reasonable data protection grounds and no alternative is available, you may end the affected part of the agreement without penalty.