Last updated: 13 June 2026
[bracketed] placeholders) before launch.
The table below lists the third parties that may process personal data on our behalf, what they do, and where they are based. We update it before adding a new sub-processor; material changes are communicated to account holders.
| Sub-processor | Purpose | Data involved | Location |
|---|---|---|---|
| Depaza | EU-sovereign AI model inference (the AI team) | Prompts & build content | EU |
| SMTP2GO | Transactional email (magic sign-in links) | Email address | EU/EEA region [confirm] |
| Stripe | Payment processing & subscriptions | Email, billing identifiers (no card data stored by us) | EU + US (SCCs) |
| Cloudflare | DNS, CDN & TLS for preview/hosted subdomains | IP address, request metadata | Global edge (EU data options) |
| [Hosting provider] | Application & database hosting | All stored account & build data | EU [confirm region] |
Where a sub-processor processes data outside the EEA (notably Stripe), the transfer is covered by the EU Standard Contractual Clauses and supplementary measures. See the Privacy Policy and DPA.
Contact privacy@buildpaza.com for our current Data Processing Agreement or to object to a new sub-processor.
We use a single essential cookie to keep you signed in — no advertising or cross-site tracking. Details.