Sub-processors
Last updated: 20 September 2026
These are the companies that handle data on our behalf so Penholder can work. Each one is under a data processing agreement with us, and we stay responsible for what they do with it. The Data Processing Agreement is where the rules live; this page is the list it points at.
Who they are
| Company | What it does for us | What it receives | Where | Transfers |
|---|---|---|---|---|
| Cloudflare | Serves the site, stores uploaded images and our backups, and runs the human check on the sign-in pages | IP address and request details; the images your team uploads; the daily backup | United States, served from the nearest edge | Data Privacy Framework, and Standard Contractual Clauses |
| FastAPI Cloud | Runs the application server | Everything the app handles while it handles it, and ordinary server logs | United States | Standard Contractual Clauses |
| Supabase | Hosts the database | Your account, your teams and everything written in them | United States | Standard Contractual Clauses |
| Brevo | Sends our email: confirmations, invitations, resets and the weekly list | Name, email address, and what the email says | European Union | Stays in the EU |
| Stripe, and Link where it sells the plan | Takes payment for teams that pay | Billing email and name, the plan, and the card details we never see | United States and Ireland | Data Privacy Framework, and Standard Contractual Clauses |
| Confirms who you are, only for people who choose to sign in with Google | Name, email address, and that the address is confirmed | United States | Data Privacy Framework |
Your browser's own push service (Google, Mozilla, Apple or Microsoft, depending on the browser) delivers a notification if you turn notifications on. We send it the address your browser gave us and a message only your browser can read. It is part of the browser you chose rather than something we picked, so it is not in the table.
When this list changes
We update this page, the agreement and the privacy policy together, and we email the owner of every paying team at least 30 days before a new company starts. If you object on reasonable data protection grounds in those 30 days, write to privacy@penholder.app; if we cannot find a way through it, you can stop using Penholder and we refund the time you paid for and did not get.
Who is not on the list
There is no analytics, no advertising, no tracking pixels, no error tracking service, no session recording, no chat widget and no AI service. Our font is served from penholder.app, so opening a page does not tell anyone else you were here. If that ever changes, it changes here first.