Legal

Sub-processors

This page names every third party that processes personal data on our behalf when you use SwellShaper, what each one does, where it processes data, and — where data leaves the EU/EEA — the specific safeguard we rely on. It is the list our Privacy Policy refers to in §4 and §5.

Last updated: 2026-07-27.

We keep this list short on purpose. We are a one-person studio and we add tools reluctantly — every provider below is one we could not reasonably run the Services without.

Current sub-processors

1. Stripe — payments

  • Entities: Stripe Payments Europe, Limited (Ireland) and Stripe, Inc. (United States).
  • What it does for us: takes payment for reservations and subscriptions, calculates tax, sends receipts, and screens for fraud.
  • Data processed: your name, email address, billing address and country, payment-method details, and transaction history. We never receive or store your full card number — it goes directly to Stripe.
  • Where: Ireland and the United States.
  • Transfer safeguard: Stripe self-certifies under the EU–US Data Privacy Framework (see its DPF policy); for anything the DPF does not cover we rely on the Standard Contractual Clauses in Stripe's Data Processing Agreement.

2. Cloudflare — website hosting, CDN and DNS

  • Entity: Cloudflare, Inc. (United States).
  • What it does for us: serves swellshaper.com and our product pages, provides DNS, TLS certificates and protection against attacks and abuse.
  • Data processed: your IP address, request metadata and browser user-agent, in transit and in short-lived security logs.
  • Where: Cloudflare's global edge network. Requests from Europe are normally served from European data centres, but Cloudflare is a US company and may access data from the United States.
  • Transfer safeguard: the Standard Contractual Clauses in Cloudflare's Data Processing Addendum. We do not claim a Data Privacy Framework certification for Cloudflare.

3. PostHog — cookieless analytics

  • Entity: PostHog, Inc. (United States), using PostHog EU Cloud.
  • What it does for us: counts page views and whether visitors click through to a checkout, so we can tell which products people actually want.
  • Data processed: aggregate event data only. In cookieless mode PostHog sets no cookies and stores nothing on your device; visitors are counted using a daily-rotating hash computed on PostHog's servers, which is not reversible and whose salt is deleted at the end of each day. We do not collect your location, and we do not record or replay sessions.
  • Where: Germany — PostHog EU Cloud runs on Amazon Web Services in Frankfurt (eu-central-1). Analytics data stays inside the EEA.
  • Transfer safeguard: none is needed for the data itself, which remains in the EEA. For any support access from the United States by PostHog, Inc., we rely on the Standard Contractual Clauses in PostHog's Data Processing Agreement. PostHog publishes its own sub-processor list.

4. Proton — email

  • Entity: Proton AG (Switzerland).
  • What it does for us: hosts our @swellshaper.com mailboxes, so it handles email you send us and email we send you.
  • Data processed: your email address and whatever your messages contain.
  • Where: Switzerland.
  • Transfer safeguard: none needed beyond the European Commission's adequacy decision for Switzerland (GDPR Art. 45), which permits transfers without additional measures.

What is not on this list

For transparency, some tools we use are deliberately absent because they never touch your personal data:

  • GitHub (Microsoft) — stores the source code of our websites. Our repositories contain no customer data.

We do not use advertising networks, data brokers, or cross-site tracking tools of any kind, so none appear here.

Changes to this list

We update this page whenever we add, replace or remove a sub-processor, and we change the "last updated" date above. If a change materially affects how your personal data is handled, we will say so here and, where the change requires it, contact you directly. If you object to a new sub-processor, email us — for a service this small, the honest remedy is usually that you stop using it and we delete your data.

Asking us about this

You can ask which safeguard applies to a specific provider, and request a copy of the relevant clauses, at any time by emailing nico@swellshaper.com. See the Privacy Policy for your full rights and how to complain to the Spanish supervisory authority (AEPD).