Subprocessors
Updated
In short: These are the outside companies that handle personal data for us, what they do, and where. There are four: Cloudflare for our website and servers, Stripe (with its company Link) for payments, Resend for account emails and Zoho for our support mailbox. None of them gets your broker logins or your trades, because those never leave your computer. We update this page before we add or change a company.
1. Current list
| Company | What it does for us | Data it handles | Where | Safeguard for transfers |
|---|---|---|---|---|
| Cloudflare, Inc. (San Francisco, USA) | Hosts our website, account server (Workers), database (D1) and app downloads (R2); protects against attacks | Everything the account server holds (see the Privacy Policy, section 2), IP addresses, request and download logs | Cloudflare's global network; USA | EU-U.S. Data Privacy Framework; Standard Contractual Clauses (Cloudflare DPA) |
| Stripe (Stripe Technology Europe, Limited, Dublin, Ireland, and its group companies, including Stripe, Inc. and Sold through Link, LLC, USA) | Payments through Stripe Managed Payments. Link (Sold through Link, LLC) is the merchant of record: it charges you, handles tax, sends receipts and invoices, and gives payment support. Stripe also keeps our subscription records. | Name, email, billing address, country, tax id, payment method (card details are held by Stripe only), payment history, IP address at checkout | EU and USA | EU-U.S. Data Privacy Framework; Standard Contractual Clauses (Stripe DPA) |
| Resend (Plus Five Five, Inc., San Francisco, USA) | Sends account emails: confirm email, reset password, order and withdrawal receipts | Email address, email content, delivery status | EU region (Ireland); support access from the USA | EU-U.S. Data Privacy Framework; Standard Contractual Clauses (Resend DPA) |
| Zoho Mail (Zoho Corporation B.V., Netherlands) | Our support mailbox (support, legal and security addresses) | What you write to us and our replies, your email address | EU data centres | Data stays in the EU; Standard Contractual Clauses for any access from outside the EU |
Stripe and Link as separate controllers. For the payment itself (fraud checks, tax, its own legal duties, Link accounts and payment support), Stripe and Link decide how to use your data under their own privacy policies: Stripe and Link.
2. Not our subprocessors
You deal with these companies directly, under their own terms and privacy policies. We do not send them your data from our servers:
- Your broker (for example Rithmic, Tradovate and TopstepX (ProjectX)). The app on your computer talks to your broker for you.
- Your prop firms.
- Telegram, if you choose to get alerts through your own Telegram bot.
- Apple and Microsoft, as makers of your operating system and of the keychain that protects your broker logins.
3. Changes
We update this page at least 30 days before a new subprocessor starts handling personal data, except in an emergency (for example a security problem with a current provider). Business customers who need an email notice can ask at legal@twincopier.com.