Subprocessors
Third parties that Data.co engages to process personal data in operating data.co, app.data.co and the Data.co Marketplace. Content processed in a customer's own Data.co Control deployment is not sent to Data.co or to any party listed here.
Subprocessors by function.
Subprocessors that may process personal data in operating data.co, app.data.co and the Marketplace. This list is Annex III of our Data Processing Addendum.
| Function | Subprocessor | Data processed | Location | Status |
|---|---|---|---|---|
| Cloud hosting for app.data.co and data.co | Hetzner Online GmbH | Account, usage and website data | Germany / Finland / United States | Active |
| Transactional email and form notifications | Twilio SendGrid | Name, email address, message content | United States | Active |
| DNS, CDN and DDoS protection | Cloudflare, Inc. | Request metadata, IP address | Global network | Active |
| Payment processing | Stripe, Inc. | Billing contact and payment data | United States | When paid plans launch |
Access is limited to each subprocessor's function.
Hetzner Online GmbH
Provides the servers, storage and network on which we run our services, CRM and CMS. Hetzner provides infrastructure and does not access the content of our systems in the ordinary course. Its role is infrastructure and physical security.
Twilio SendGrid
Delivers email. It receives the content of the messages we send, including form submissions forwarded to our staff (name, email, company, message and form answers) and transactional email to account holders. It does not receive account credentials or API data.
Cloudflare
Sits in front of our websites and APIs to resolve DNS, cache public content and filter attacks. It processes IP addresses, request headers and metadata, and the traffic passing through it, which is encrypted in transit.
Stripe
Will process payments when paid plans launch. Cardholder data is entered directly with Stripe; Data.co receives only payment status, card brand, last four digits and billing details, never full card numbers.
Before engaging a subprocessor, we:
- Confirm the function needs personal data, and limit what it receives to the minimum needed
- Review its security practices, including available third-party audit reports and certifications
- Review its privacy terms and data processing agreement, and require obligations no less protective than our Data Processing Addendum
- Confirm a valid international transfer mechanism, such as Standard Contractual Clauses or Data Privacy Framework certification, where data leaves the EEA, UK or Switzerland
- Record where it processes data and for how long
- Re-review existing subprocessors periodically and when their services or terms change materially
Where personal data is stored and processed.
Our primary systems, including app.data.co, the Marketplace, our self-hosted CRM and our self-hosted CMS, run on servers at Hetzner data centers in Germany, Finland and the United States. Email processing by Twilio SendGrid and payment processing by Stripe take place in the United States. Cloudflare processes request data at the edge location nearest the visitor on its global network.
Transfers out of the EEA, UK and Switzerland are covered by the safeguards described in our Privacy Policy and Data Processing Addendum. Enterprise customers with specific residency requirements can contact us to discuss them, or run Data.co Control in their own infrastructure, where customer content never reaches Data.co.
How we notify changes.
We update this page before a new subprocessor begins processing personal data. Where our Data Processing Addendum applies, we give at least 30 days' notice before a new subprocessor processes customer personal data, and customers may object as the addendum describes.
To receive email notice of changes, subscribe through the contact form at data.co/contact: choose the topic "Other" and write "Subscribe to subprocessor updates" in the message. Customers with a signed Data Processing Addendum are notified at their designated contact address automatically.
What this list does not cover.
- Infrastructure you run Data.co Control on, which you select and contract for directly
- Model providers you choose to register as endpoints in your own deployment
- Marketplace data providers, which license datasets to you and do not process your personal data on our behalf
- Our self-hosted CRM and content management system, which run on our own infrastructure and are not third parties
- Affiliates, unless listed above
Contact.
Questions about our subprocessors can be sent through the contact form at data.co/contact. A copy of a subprocessor's data protection terms relevant to your data is available on request, subject to confidentiality.
Last updated: November 6, 2026.
Questions about these terms?
Contact us and we will route your question to the right person.