Sub-processors.
CSP Logger is operated by Lova Labs (KvK 42103900). To run the service we rely on the third parties below, each of which processes personal data on our behalf under a data processing agreement. This list is referenced by our Privacy Policy.
1. Current sub-processors
| Sub-processor | Service | Data processed | Location | Transfer basis |
|---|---|---|---|---|
| Supabase Inc. | Managed PostgreSQL hosting | All operational data: account info, project metadata, raw and processed violation reports, policies, filter rules | US entity; data hosted in the EU (Frankfurt) | EU data residency + SCCs (Module Three) |
| Anthropic PBC | LLM API for identifying unfamiliar origins | The domains configured for the project, and an aggregated table of blocked origins per directive with event counts, counts of distinct pages affected, how many other origins shared a page, and ages in whole days. No page URLs, no report times, no IP addresses, no end-user personal data. | US | SCCs (Module Three, Anthropic Commercial Terms); no training on API data |
| Resend Inc. | Transactional email delivery | Recipient email, message content (including violation summaries in the weekly digest), send metadata | US (EU sending region) | SCCs (Module Three) |
| Cloudflare Inc. | DNS, marketing-site hosting, email routing, edge security, reverse proxy for the violation ingest endpoint, and encrypted storage of our nightly database backups (R2) | Marketing-site and ingest-endpoint request metadata (IP, user-agent); inbound email routed to us. Report bodies pass through the proxy in transit and are not retained there. Since 2026-09-15 a nightly backup copy of the whole database is stored in an R2 bucket located in the European Union, kept for 30 days and then deleted | US company; backup bucket in the EU | SCCs (Module Three) |
| Hetzner Online GmbH | Virtual server hosting for the dashboard, the violation ingest endpoint, and our self-hosted error tracker (GlitchTip) | Dashboard application data at rest, sessions, queues, application logs; inbound report bodies (transient, in memory only); the HTTP response headers and page content fetched from your site during policy verification (also transient, in memory only); error stack traces scrubbed of personal data, kept 30 days | Germany (EU) | EU-based; no international transfer |
| Google LLC | Google Analytics 4 (marketing site, with consent) | Visitor IP (anonymised by GA4), user-agent, page paths, only if you accept analytics cookies | US | SCCs (Google data-processing terms) |
Paddle is not in this list. Paddle is our Merchant of Record, and for the billing data it handles it acts as an independent controller, not our sub-processor. See Privacy Policy §4 and Paddle's own privacy notice.
2. Changes to this list
We may engage new sub-processors as the service evolves. We will give at least 30 days' notice by email before a new sub-processor starts processing your personal data.
3. Objecting to a sub-processor
You may object to a new sub-processor on reasonable data-protection grounds. If we cannot offer a workable alternative, you may terminate the affected service, with any refund handled under our Refund Policy via Paddle.
4. Contact
Questions or objections? Email privacy@csplog.io.