To run SmartKDP we rely on a small number of service providers. Under the GDPR these are our "subprocessors", and we think you are entitled to know who they are whether or not the law requires it of us.
We keep this list deliberately short. Every addition is a company you have to trust because you trust us.
Current subprocessors
| Provider | What it does | Location | Status |
|---|---|---|---|
| Google Cloud Platform | Application hosting, database (Cloud SQL), file storage (Cloud Storage), caching (Memorystore), and secret management. The primary place your account and project data lives. | United States | In use |
| Firebase Authentication (Google) | Verifies your identity when you sign in with email or Google. Handles the password check itself, so we never see or store your password. | United States | In use |
| Lemon Squeezy | Merchant of record for every purchase: payment processing, subscription billing, sales tax and VAT determination and remittance, invoices, receipts, and refunds. Lemon Squeezy is the seller of record for your order, so your card details are entered directly into Lemon Squeezy's checkout and never reach our servers. | United States | In use |
| Stripe | Alternative payment processor. Integrated but not currently in use — Lemon Squeezy handles all purchases today. Listed in advance so its addition is never a surprise. | United States, with EU processing for EU customers | Not yet in use |
| Google Analytics (Google Ireland Limited) | Website and product analytics: which pages are visited, which features are reached, and where visitors drop out. Engaged only after you accept analytics cookies — Google Consent Mode denies analytics storage until then. No advertising, no remarketing, no Google Signals, and no name, email address, or account identifier is ever sent. | European Union, with processing in the United States under the EU–US Data Privacy Framework | In use |
| Listmonk (self-hosted) and our email delivery provider | Newsletter and transactional email delivery. The subscriber list is stored on infrastructure we run; the delivery relay transmits the messages. | United States | In use |
| Anthropic | Powers AI-assisted writing features. Not currently in use — listed in advance so its addition is never a surprise. | United States | Not yet in use |
Where processing happens
Most processing takes place in the United States.
Where personal data of individuals in the EEA or the UK is transferred to the United States, we rely on the transfer safeguards offered by the provider — typically the European Commission's Standard Contractual Clauses, together with the provider's own certifications.
What is not on this list
- We do not use advertising networks or data brokers. No third party receives your data for advertising, and we do not sell personal data.
- Our analytics provider receives nothing that identifies you personally — no name, no email address, no account id. It receives a cookie identifier only if you accept analytics cookies, and nothing at all if you decline.
- Lemon Squeezy is our merchant of record, not just a payment processor. Lemon Squeezy is the seller for every order and an independent controller for the payment transaction, handling billing, sales tax and VAT, receipts, and refunds. Card numbers are transmitted directly from your browser to Lemon Squeezy and never reach our servers.
Changes to this list
If we add a subprocessor that will process customer personal data, we will update this page before it goes live. Customers on business or team plans who want advance notice of changes can request it at support@smartkdp.com, and we will email you when this page changes.
If you object to a new subprocessor, tell us — we will discuss it, and if we cannot resolve it you may cancel and receive a pro-rata refund of any prepaid period.
Questions
Email support@smartkdp.com. If you need a Data Processing Agreement for your own compliance obligations, ask and we will arrange one.