To run SmartKDP we rely on a small number of service providers. Under the GDPR these are our "subprocessors", and we think you are entitled to know who they are whether or not the law requires it of us.
We keep this list deliberately short. Every addition is a company you have to trust because you trust us.
Current subprocessors
| Provider | What it does | Location | Status |
|---|---|---|---|
| Google Cloud Platform | Application hosting, database (Cloud SQL), file storage (Cloud Storage), caching (Memorystore), and secret management. The primary place your account and project data lives. | United States | In use |
| Firebase Authentication (Google) | Verifies your identity when you sign in with email or Google. Handles the password check itself, so we never see or store your password. | United States | In use |
| Stripe | Payment processor for every purchase: card, Apple Pay, and Google Pay payments, subscription billing, fraud prevention, and calculation of the sales tax or VAT included in our prices (Stripe Tax). Card details are entered directly into Stripe's payment fields and never reach our servers; receipts are Stripe-hosted and linked from your billing page. | United States, with EU processing for EU customers | In use |
| Cloudflare | Serves the website itself (CDN, DNS, and the Workers runtime the site runs on) and delivers the product demo videos. As the network in front of everything, it processes the IP address and request details of every visit for routing, caching, and protection against attack. The video player is loaded only if you press play. | Global edge network, with the operating entity in the United States | In use |
| Google Analytics (Google Ireland Limited) | Website and product analytics: which pages are visited, which features are reached, and where visitors drop out. Engaged only after you accept analytics cookies — Google Consent Mode denies analytics storage until then. No advertising, no remarketing, no Google Signals, and no name, email address, or account identifier is ever sent. | European Union, with processing in the United States under the EU–US Data Privacy Framework | In use |
| Listmonk (self-hosted) | Holds the newsletter subscriber list and composes both newsletter and transactional email (receipts, payment notices, account alerts). Open-source software running on our own infrastructure, so the list is never held by a third-party marketing platform. | United States | In use |
| Amazon Web Services (Amazon SES) | Delivers our outgoing email. SES is the relay: it transmits each message and processes the recipient address and delivery result (delivered, bounced, marked as spam) so we stop mailing addresses that reject us. It does not hold our subscriber list. | United States | In use |
| Anthropic | Powers AI-assisted writing features. Not currently in use — listed in advance so its addition is never a surprise. | United States | Not yet in use |
Where processing happens
Most processing takes place in the United States.
Where personal data of individuals in the EEA or the UK is transferred to the United States, we rely on the transfer safeguards offered by the provider — typically the European Commission's Standard Contractual Clauses, together with the provider's own certifications.
What is not on this list
- We do not use advertising networks or data brokers. No third party receives your data for advertising, and we do not sell personal data.
- Our analytics provider receives nothing that identifies you personally — no name, no email address, no account id. It receives a cookie identifier only if you accept analytics cookies, and nothing at all if you decline.
- Our newsletter list is not hosted by a marketing company. The subscriber list runs on Listmonk, open-source software on our own infrastructure, so no third-party marketing platform holds it. Amazon SES appears below only because it is the relay that carries the messages — it transmits them, it does not hold the list.
- Stripe processes payments; it is not the seller. SmartKDP, Inc. is the seller of record for every order. Card numbers are transmitted directly from your browser to Stripe and never reach our servers, and Stripe calculates the sales tax or VAT already included in our prices (Stripe Tax) — remitting it is our responsibility, not Stripe's.
Changes to this list
If we add a subprocessor that will process customer personal data, we will update this page before it goes live. Customers on business or team plans who want advance notice of changes can request it at support@smartkdp.com, and we will email you when this page changes.
If you object to a new subprocessor, tell us — we will discuss it, and if we cannot resolve it you may cancel and receive a pro-rata refund of any prepaid period.
Questions
Email support@smartkdp.com. If you need a Data Processing Agreement for your own compliance obligations, ask and we will arrange one.