Sub-processors.
CSP Logger is operated by Lova Labs (KvK 42103900). To run the service we rely on the third parties below, each of which processes personal data on our behalf under a data processing agreement. This list is referenced by our Privacy Policy.
1. Current sub-processors
| Sub-processor | Service | Data processed | Location | Transfer basis |
|---|---|---|---|---|
| Supabase Inc. | Managed PostgreSQL hosting | All operational data: account info, project metadata, raw and processed violation reports, policies, filter rules | US entity; data hosted in the EU (Frankfurt) | EU data residency + SCCs |
| Anthropic PBC | LLM API for policy generation | Aggregated blocked-origin counts per directive, plus your registrable domain and any CSP header you provide. No page URLs, no IP addresses, no end-user personal data. | US | SCCs (Anthropic Commercial Terms); no training on API data |
| Paddle.com Market Ltd | Merchant of Record (payments, tax, invoicing) | Customer email, billing address (for tax), Paddle customer ID, subscription state. Card data is handled entirely by Paddle and never reaches our systems. | United Kingdom | UK adequacy decision |
| Resend Inc. | Transactional email delivery | Recipient email, message content (including violation summaries in the weekly digest), send metadata | US (EU sending region) | SCCs |
| Cloudflare Inc. | DNS, marketing-site hosting, email routing, edge security, and reverse proxy for the violation ingest endpoint | Marketing-site and ingest-endpoint request metadata (IP, user-agent); inbound email routed to us. Report bodies pass through in transit and are not stored by Cloudflare | US | SCCs |
| Sentry (Functional Software, Inc.) | Error and uptime monitoring | Error stack traces (scrubbed of personal data); monitoring metadata | US | SCCs |
| Hetzner Online GmbH | Virtual server hosting for the dashboard and the violation ingest endpoint | Dashboard application data at rest, sessions, queues, application logs; inbound report bodies (transient, in memory only) | Germany (EU) | EU-based; no international transfer |
| Google LLC | Google Analytics 4 (marketing site, with consent) | Visitor IP (anonymised by GA4), user-agent, page paths, only if you accept analytics cookies | US | SCCs (Google data-processing terms) |
2. Changes to this list
We may engage new sub-processors as the service evolves. We will give at least 30 days' notice by email before a new sub-processor starts processing your personal data.
3. Objecting to a sub-processor
You may object to a new sub-processor on reasonable data-protection grounds. If we cannot offer a workable alternative, you may terminate the affected service, with any refund handled under our Refund Policy via Paddle.
4. Contact
Questions or objections? Email privacy@csplog.io.