Sub-processors
Last updated: 2 May 2026
Under GDPR Article 28(2), we are required to disclose every third-party service (“sub-processor”) that processes data on our behalf. This is the complete list. We will notify customers by email at least 30 days before adding a new sub-processor.
Important distinction: only Cloudflare processes visitor analytics data (hashed, non-personally-identifiable). Stripe only processes customer billing data (your payment details when you subscribe to Glinto). Brevo only processes your email address for transactional emails such as password resets. Authentication is handled entirely in-house within our EU database. Visitors to websites using the Glinto pixel never interact with Stripe or Brevo.
Cloudflare, Inc.
Infrastructure provider · United States
- Data processed
- Visitor analytics events (hashed, non-PII), D1 database (site config, account data), KV cache, Workers AI inference.
- Data residency
- D1 database: EU (WEUR jurisdiction). Analytics Engine and KV: Cloudflare global edge. Workers AI: nearest inference node.
Stripe, Inc.
Payment processing · United States / Ireland
- Data processed
- Customer billing name, email, payment method, invoices. Stripe does NOT process visitor analytics data.
- Data residency
- EU for EU-based customers (Stripe Payments Europe, Ltd., Ireland).
Brevo (Sendinblue SAS)
Transactional email delivery · France
- Data processed
- Customer email address, used solely to send transactional emails (password reset, account notifications). Visitor analytics data is never sent to Brevo.
- Data residency
- EU (France). Brevo is an EU-headquartered company; no international transfer occurs.
Transfer mechanisms
Cloudflare and Stripe are certified under the EU-U.S. Data Privacy Framework (DPF), which provides an adequate level of data protection as recognised by the European Commission’s adequacy decision of 10 July 2023. Where DPF does not apply, Standard Contractual Clauses (SCCs) are in place as a fallback mechanism. Brevo (Sendinblue SAS) is headquartered in France and is subject to EU law; no international data transfer occurs.
Questions about our sub-processors? Contact dpo@glinto.eu.