Subprocessors

This page lists the third-party subprocessors (vendors and service providers) that Zenovay ("Zenovay", "we", "us", or "our") uses to assist in providing, maintaining, and improving our analytics platform and related services.

Each subprocessor listed here is engaged on written data processing terms that require it to process personal data only on our instructions, to keep it confidential, to apply appropriate security measures and to assist with data subject requests. We have not carried out our own independent security audit of these providers, and we do not claim to have done so: where a provider holds an independent certification or audit report, we identify it as that provider's, not ours.

What is a Subprocessor

A subprocessor is a third-party data processor engaged by Zenovay to assist in providing our Services. These subprocessors may process customer data on our behalf for purposes such as:

• Hosting infrastructure and content delivery
• Database management and data storage
• Payment processing and subscription management
• Email delivery and communication services
• Authentication and identity management
• Analytics and monitoring services

Current Subprocessors

The following table lists all active subprocessors used by Zenovay as of the date shown above:

Optional Subprocessors

The following subprocessors are only engaged when customers enable specific optional features:

Data Processing Standards

The data processing terms we accept from these providers require them to:

• Maintain appropriate technical and organizational security measures to protect customer data
• Process data only in accordance with Zenovay's documented instructions
• Comply with applicable data protection laws, including data protection regulations, CCPA, and other relevant regulations
• Make available the information needed to demonstrate compliance with those terms
• Notify Zenovay promptly of any data breaches, security incidents, or unauthorized access
• Assist with data subject requests, including access, deletion, and portability requests
• Impose equivalent obligations on any further subprocessor they engage
• Return or delete customer data upon termination of services, as instructed

Data minimization

Zenovay applies data minimisation to analytics. Audience insights such as language, locale and time-zone distribution are inferred only from request metadata that the visitor's browser already sends with every page request (the Accept-Language header and the CDN's timezone signal). We collect no additional data for this purpose, set no cookies or local storage for it, and use no third-party demographic-enrichment provider. These signals are processed in aggregate, are not used to build individual profiles, and are not derived at all when a visitor sends a Global Privacy Control signal.

International Data Transfers

Zenovay's primary database (Supabase) is hosted in the European Union (eu-central-1, Frankfurt) since 24 April 2026, and Cloudflare R2 (heatmap screenshots) is configured with EU data location preference. Some of our other subprocessors (e.g. Stripe, Resend, OpenAI via Cloudflare AI Gateway) are US-based, which may involve transfers of personal data outside the European Economic Area (EEA) to countries that do not provide the same level of data protection as EEA countries.

For transfers of personal data from the EEA to countries without an adequacy decision, we ensure compliance through:

• EU-US Data Privacy Framework (DPF) / Swiss-US DPF: For US-based subprocessors that are certified under the EU-US and Swiss-US Data Privacy Framework, we rely on the DPF as a valid transfer mechanism (European Commission Adequacy Decision of 10 July 2023).
• Standard Contractual Clauses (SCCs): We use European Commission-approved Standard Contractual Clauses (Decision 2021/914) with subprocessors that are not certified under the DPF or as an additional safeguard.
• Data Processing Agreements (DPAs): Each subprocessor is engaged under written data processing terms containing the protections described above.
• Adequacy Decisions: Where applicable, we rely on adequacy decisions issued by the European Commission for certain countries.
• Supplementary Measures (Schrems II): Encryption in transit, encryption at rest by the storing provider, access controls, and data minimisation, so that a provider outside the EEA receives only what its specific function requires.

Updates to This List

Zenovay may add, remove, or replace subprocessors from time to time as our business needs evolve, technology changes, or to improve our Services.

When we make changes to our subprocessors, we will:

• Update this page with the current list of subprocessors
• Update the "Last update" date at the top of this page
• Provide at least 30 days' advance notice to paying customers before adding new subprocessors
• Notify paying customers via email about material changes to subprocessors
• Provide paying customers with the right to object to new subprocessors on reasonable data protection grounds

We recommend checking this page periodically to stay informed about our current subprocessors. You may also subscribe to email notifications about subprocessor updates.

Your Rights

As a Zenovay customer, you have the right to:

• Request information about our subprocessors and their data processing activities
• Object to a new subprocessor on reasonable data protection grounds, in writing and within 10 days of our notice, as set out in Section 5.3 of the Data Processing Agreement
• Ask which data protection terms govern a given subprocessor, and receive those terms or a summary of them to the extent we are permitted to share them
• Verify our compliance through the audit mechanism in Section 8 of the Data Processing Agreement: provider certifications and reports, an annual questionnaire, and, in exceptional circumstances, an audit on reasonable notice and at your cost
• Terminate the affected Services if we cannot offer a commercially reasonable alternative to a subprocessor you have reasonably objected to

Enterprise customers with specific data processing requirements may contact us to discuss customized data processing arrangements.

Contact Information

If you have questions about our subprocessors, data processing practices, or would like to subscribe to subprocessor update notifications, please contact us: