# Sub-processors

> Draft for lawyer review

Last updated: 2026-11-03

The companies that process data for Arcadium Data, what each one does and where.

DRAFT. Lawyer review pending. Items marked [L] are open questions for the lawyer and [A] are facts still to be checked.

These companies process personal data for us when you use arcadiumdata.io, the API or the MCP server. Our [privacy notice](/legal/privacy/) says what data we hold and our [Data Processing Addendum](/legal/dpa/) says how we add or change a sub-processor. Account holders get at least 30 days' email notice before a new one starts.

| Company | What it does for us | Data it can see | Location |
| --- | --- | --- | --- |
| Hetzner Online GmbH, Germany | Hosts our servers and database | Everything stored on our servers | Germany [A1] |
| Cloudflare, Inc., United States | Delivers the website, counts page views (Cloudflare Web Analytics, no cookies), protects the network, runs the bot check on forms, controls access to our test environment, stores our encrypted backups and public catalogue files | Requests to our sites (including IP addresses); backups only in encrypted form | EU and worldwide network |
| Resend (Plus Five Five, Inc.), United States | Sends sign-in links, confirmations and service notices | Recipient email address and message content | United States [A2] |
| Google LLC / Google Ireland Ltd. (Workspace) | Our email inbox | Messages you send us | EU and United States [A3] |
| Stripe Payments Europe, Ltd., Ireland | Takes card payments, refunds and disputes, from the day payments open | Payment details, billing name, company and VAT ID, email | Ireland, with transfers to the United States |
| Cloud compute and proxy infrastructure provider (EU) | Runs the scrapers with your inputs and holds results until we delete them | Run inputs and results | EU [L1] |

The bot check on our forms sends technical data about your browser and connection to Cloudflare. We send Cloudflare only the check token, not your IP address.

## Transfers outside the EU

Our servers and database are in the EU. Where a provider processes data in the United States, the transfer relies on the EU-US Data Privacy Framework for certified providers, or on the European Commission's standard contractual clauses. [L2]

## Changes

| Date | Change |
| --- | --- |
| 2026-11-03 | First version |

---

## Questions for the lawyer and facts to check

Remove this section and every [L] and [A] marker before publishing.

- [L1] Do we have to name the cloud compute and proxy infrastructure provider? Its terms forbid connecting its name with our copyrighted works and we do not name it in marketing. Is a factual entry here required under GDPR Art. 28(2) and (4), and is it compatible with those terms? The provider uses its own sub-processors, including proxy networks.
- [L2] Transfer mechanism per US provider.
- [A1] Confirm the Hetzner data centre location of the production server.
- [A2] Confirm the Resend legal entity and sending region of our account.
- [A3] Confirm that hello@arcadiumdata.io is received through Google Workspace and which Google entity is our contracting party.