Sub-processors
These are the third parties that process personal data on behalf of Serointech VOF ("Incogsurf"). Every entry lists the legal entity, its role, the region where it processes data, what data flows to it, and the date it was added.
Effective date: 2026-05-20. We will notify subscribers via email at least 30 days before adding or replacing a sub-processor. You may object to a new sub-processor by terminating your subscription before the change takes effect.
Current sub-processors
| Name | Legal entity | Role | Region | Data flow | Added | Privacy |
|---|---|---|---|---|---|---|
| Supabase | Supabase Inc. (Delaware, US) — EU project at eu-west-1 | Database, authentication, storage, Edge Functions, Vault for secret storage | EU (eu-west-1, Ireland) | Account data, identity tuples (encrypted at rest), billing references, audit events, notifications, feedback | 2026-04-12 | Policy |
| Stripe | Stripe Payments Europe, Limited (Dublin, Ireland) | Payment processing, invoicing, OSS VAT collection | EU (Ireland) + US (Stripe parent) | Email, billing address, payment method (card data entered directly into Stripe Checkout), VAT ID | 2026-05-01 | Policy |
| Vercel | Vercel Inc. (Delaware, US) | Web hosting for incogsurf.com (marketing) and incogsurf-admin.vercel.app (admin dashboard) | EU edge (fra1) + US origin | IP address, user-agent for HTTP requests. No application data is stored on Vercel infrastructure | 2026-04-12 | Policy |
| Resend | Resend B.V. (Amsterdam, Netherlands) | Transactional email delivery | EU (Netherlands) | Recipient email address, message body, send metadata. Plain-text addresses live only in transit; our send log stores SHA-256 hashes | 2026-05-10 | Policy |
| Cloudflare | Cloudflare, Inc. (San Francisco, US) | DNS resolution for incogsurf.com; inbound email routing for support@/abuse@/privacy@ | Global edge (CDN); EU/US | DNS queries; forwarded email envelopes for the routed mailboxes | 2026-04-12 | Policy |
| Sentry | Functional Software, Inc. d/b/a Sentry — EU ingest by Sentry GmbH (Vienna) | Application error monitoring (Electron app, marketing site, admin dashboard, Edge Functions) | EU (de.sentry.io) | Error messages, stack traces, OS + browser metadata. JWTs, Stripe keys, and known PII fields are stripped client-side before transmission | 2026-05-20 | Policy |
| BetterStack | Better Stack s.r.o. (Prague, Czech Republic) | Uptime monitoring and public status page | EU (Czech Republic) | HTTP probe results (status code, latency, response body for keyword checks) for our own endpoints only. No user data | 2026-05-20 | Policy |
| PlainProxies | PlainProxies (Netherlands) | Residential proxy infrastructure for profile network egress (when enabled) | EU (Netherlands) | Per-profile session credentials, bandwidth metering. Site traffic from your profiles is routed through PlainProxies' network | 2026-04-20 | Policy |
| Twilio | Twilio Ireland Limited (Dublin, Ireland) | SMS delivery for MFA enrolment and phone-number validation | EU (Ireland) | Phone number, SMS body (one-time code). Carrier metadata for delivery routing | 2026-04-25 | Policy |
International transfers
Our primary infrastructure (Supabase, Vercel deployments, Resend, Sentry, BetterStack, Twilio) is configured for EU regions. Where a sub-processor or its parent operates infrastructure outside the EU/EEA, transfers rely on the EU-US Data Privacy Framework (where applicable) and standard contractual clauses (Commission Implementing Decision 2021/914).
Notifications of change
Subscribers receive an email at least 30 days before any sub-processor is added, replaced, or removed. Objections may be raised at privacy@incogsurf.com on reasonable data-protection grounds; if the objection cannot be resolved, the subscription may be terminated with refund of the unused portion of the current billing period (consistent with the Data Processing Addendum, section 6).
These documents are drafts pending counsel review. Where a clause conflicts with mandatory Dutch consumer law (Burgerlijk Wetboek Book 6 or Book 7) or applicable EU law (GDPR, ePrivacy, DSA), the mandatory rule prevails over the drafted clause. Contact privacy@incogsurf.com to flag any drafting issue.