Subprocessors
These are the companies that process personal data on our behalf, what they do for us, and where. We give 30 days’ notice before adding or changing one. The terms are in our Data Processing Agreement.
| Who | What for | Whose data | Where, and how transfers are covered |
|---|---|---|---|
| Cloudflare, Inc. | Hosts and delivers the banner, dashboard and API; holds the database of consent records; runs the browser for site checks; runs AI models that classify cookies and text; sends sign-in and notice emails. | Visitors: consent records, including the country, which is worked out from the IP address; the IP address is then discarded and never stored. Customers: account details, site settings and dashboard use. | Consent records and accounts: a database restricted to the EU. Delivery: Cloudflare’s network, worldwide. Data Processing Addendum with the EU Standard Contractual Clauses; EU-U.S. Data Privacy Framework. |
| Stripe, Inc. and Stripe Payments Europe, Ltd. | Takes payments and handles subscriptions and invoices for paid plans. | Customers only: billing contact, company, tax ID, payment method. No visitor data. | EU and United States. Data Processing Agreement with the EU Standard Contractual Clauses; EU-U.S. Data Privacy Framework. |
| Google LLC (Gmail) | Runs our support inbox, which receives the email you send to hello@flatconsent.com. | Customers only: what you write to us. | United States and elsewhere. Google’s data processing terms with the EU Standard Contractual Clauses; EU-U.S. Data Privacy Framework. |
Services that receive no personal data
- DigiCert and Sectigo: Put trusted timestamps (RFC 3161) on each day’s fingerprint of consent records. They receive only a hash.
- Cloudflare DNS over HTTPS: Looks up the DNS record that proves a company owns its email domain, for single sign-on.
- TypeSafe (Jev): An AI model that sorts cookies into categories and checks banner wording. It receives cookie names, the web addresses that set them, and a site’s banner text, but nothing about visitors.
Get notice of changes
We email the owners and admins of every workspace. Anyone else (your DPO, for example) can sign up here.
Changes
- 25 September 2026: First published list: Cloudflare, Stripe and Google (Gmail, for the support inbox).