Stackie Subprocessor and Third-Party Recipient List

This Subprocessor and Third-Party Recipient List identifies public subprocessors and third-party recipients approved for Stackie processing where Stackie Ltd acts as processor, service provider, contractor, or similar role. It also identifies relevant notice periods and transfer information for those approved recipients.

General Authorization

Where the applicable agreement or DPA permits general subprocessor authorization, Customer authorizes Stackie Ltd to use the entries listed below that act as subprocessors. Independent controllers and other third-party recipients are disclosed for transparency but are not deemed subprocessors solely because they appear in this list. Stackie Ltd will maintain written obligations with subprocessors as required by applicable law and will remain responsible for subprocessor performance to the extent required by the applicable agreement.

Notice and Objection

Stackie Ltd will publish or provide notice of new or replacement subprocessors according to the notice period listed below or in the signed agreement. Customer may object on reasonable data-protection grounds during the applicable notice period. If Stackie Ltd cannot reasonably resolve the objection, either party may terminate the affected service to the extent required by applicable law or the signed agreement.

Transfers

Where international transfer safeguards are required, Stackie Ltd uses appropriate safeguards such as adequacy decisions, standard contractual clauses, UK international data transfer terms, supplementary measures, and transfer assessments as reflected in the current register and applicable agreement.

Service Categories Not Yet Active

Some product categories, such as analytics, marketing email, support desk, crash reporting, customer chat, newsletters, and session replay, may require additional providers before activation. A provider is not approved unless it appears in the public list below or is otherwise approved in a signed agreement.

Public Subprocessor and Third-Party Recipient List

Approved Subprocessors and Service Providers

Vendor Legal Name	Service Category	Role	Purpose	Regions	Transfer Mechanism	Transfer Coverage	Transfer Notice Days	Change Notice Days	Notice/Objection Route	Replacement Notice
Cloudflare, Inc.	Package and encrypted infrastructure state storage	processor	Stores package artifacts and delivery metadata for Stackie downloads, plus encrypted infrastructure state needed to operate the service.	United Kingdom, European Union and EEA, United States	EEA Standard Contractual Clauses	EEA Standard Contractual Clauses, UK Addendum to the EEA SCCs, UK International Data Transfer Agreement, Data Privacy Framework or equivalent certified transfer basis	30	30	Email [email protected] for DPA, subprocessor, transfer, or objection notices.	Stackie will publish notice before material replacement where required by the DPA or applicable law.
Cloudflare, Inc.	Cloud application hosting and request handling	processor	Runs Stackie Cloud request handling, rate limiting, and service runtime operations.	United Kingdom, European Union and EEA, United States	EEA Standard Contractual Clauses	EEA Standard Contractual Clauses, UK Addendum to the EEA SCCs, UK International Data Transfer Agreement, Data Privacy Framework or equivalent certified transfer basis	30	30	Email [email protected] for DPA, subprocessor, transfer, or objection notices.	Stackie will publish notice before material replacement where required by the DPA or applicable law.
Cloudflare, Inc.	Transactional email delivery	processor	Sends account verification, password reset, and account lifecycle emails.	United Kingdom, European Union and EEA, United States	EEA Standard Contractual Clauses	EEA Standard Contractual Clauses, UK Addendum to the EEA SCCs, UK International Data Transfer Agreement, Data Privacy Framework or equivalent certified transfer basis	30	30	Email [email protected] for DPA, subprocessor, transfer, or objection notices.	Stackie will publish notice before material replacement where required by the DPA or applicable law.
Neon, Inc.	Managed database hosting	processor	Stores Stackie Cloud account, authentication, billing, audit, security, usage, and package metadata records.	United Kingdom, European Union and EEA, United States	EEA Standard Contractual Clauses	EEA Standard Contractual Clauses, UK Addendum to the EEA SCCs, UK International Data Transfer Agreement, Data Privacy Framework or equivalent certified transfer basis	30	30	Email [email protected] for DPA, subprocessor, transfer, or objection notices.	Stackie will publish notice before material replacement where required by the DPA or applicable law.
Functional Software, Inc. d/b/a Sentry	Operational fault monitoring and private diagnostic release artifacts	processor	Receives minimized operational telemetry and private JavaScript release artifacts needed to detect, diagnose, measure and remediate faults on approved Stackie surfaces.	European Union and EEA, United States	EEA Standard Contractual Clauses	EEA Standard Contractual Clauses, UK Addendum to the EEA SCCs, UK International Data Transfer Agreement, Data Privacy Framework or equivalent certified transfer basis	30	30	Email [email protected] for DPA, subprocessor, transfer, or objection notices.	Stackie will publish notice before material replacement where required by the DPA or applicable law.

Independent Controllers and Payment Providers

Vendor Legal Name	Service Category	Role	Purpose	Regions	Transfer Mechanism	Transfer Coverage	Transfer Notice Days	Change Notice Days	Notice/Objection Route	Replacement Notice
Google LLC	Optional account sign-in provider	independent controller	Provides Google account sign-in when a user chooses that method.	United States, European Union and EEA, United Kingdom	Data Privacy Framework or equivalent certified transfer basis	Data Privacy Framework or equivalent certified transfer basis, contractual transfer terms	30	30	Email [email protected] for third-party recipient privacy questions.	Independent controller sign-in provider entry; disclosed separately from subprocessor approvals.
Paddle.com Market Limited	Merchant-of-record billing and tax services	independent controller	Provides checkout, subscription management, invoicing, tax, and billing support as merchant of record.	United Kingdom, European Union and EEA, United States	Data Privacy Framework or equivalent certified transfer basis	Data Privacy Framework or equivalent certified transfer basis, contractual transfer terms	30	30	Email [email protected] for billing-recipient privacy questions.	Stackie will publish notice before material replacement where required by the DPA or applicable law.

Notice and Transfer Evidence

Recipient	Role	Notice Days	Recipient Terms Posture
Paddle.com Market Limited - Merchant-of-record billing and tax services	independent controller	30	Covered by recipient-specific written terms
Google LLC - Optional account sign-in provider	independent controller	30	Independent controller terms apply; no processor addendum is required for this disclosed role
Cloudflare, Inc. - Cloud application hosting and request handling	processor	30	Covered by written processor or subprocessor terms
Cloudflare, Inc. - Transactional email delivery	processor	30	Covered by written processor or subprocessor terms
Cloudflare, Inc. - Package and encrypted infrastructure state storage	processor	30	Covered by written processor or subprocessor terms
Neon, Inc. - Managed database hosting	processor	30	Covered by written processor or subprocessor terms
Functional Software, Inc. d/b/a Sentry - Operational fault monitoring and private diagnostic release artifacts	processor	30	Covered by written processor or subprocessor terms