In short: this is the full list of companies that touch data on our behalf. Each is bound to process it only on our instructions. We keep the list short on purpose.
1. Current subprocessors
| Vendor | What it does for us | Data involved |
|---|---|---|
| Vercel | Hosts the website and API | Request metadata, account data in transit |
| Supabase | Managed PostgreSQL database | Account details, capture metadata, view counts |
| Backblaze B2 | Object storage for captures | Your screenshots and recordings |
| Cloudflare | Edge delivery for share links, custom domains, TLS | Request metadata, capture bytes in transit |
| Resend | Transactional email (verification, password reset) | Email address, name, one-time codes |
A payment processor will be added to this list when paid plans go live; it will handle card details directly so that we never receive them. We will update this page before that happens.
2. How we choose and manage them
- We only add a vendor when it is necessary to run the service.
- Each is covered by a data processing agreement limiting them to our instructions.
- Where data leaves the UK/EEA we rely on Standard Contractual Clauses.
- We review the list when we change infrastructure.
3. Notice of changes
If we add or replace a subprocessor that handles personal data, we update this page and, for business customers with a signed DPA, give at least 30 days’ notice so you can object. To be notified of changes, email privacy@wacdum.com.