Sub-processors
To run wcally we rely on a small number of service providers. This page names every one of them, what they do, and where they do it. We keep it here — on its own page — so that a change to the list never means quietly editing another document.
The list
- Cloudflare, Inc. — sub-processor — global edge network — hosting, content delivery, storage and security.
- Amazon Web Services (Amazon SES) — sub-processor — Frankfurt, European Union — transactional and, if you opt in, marketing email.
- Hetzner Online GmbH — sub-processor — Germany, European Union — the servers that run our statistics infrastructure.
- Lemon Squeezy — independent controller, not a sub-processor — United States — subscription sales, invoicing and tax.
Why Lemon Squeezy is listed differently
Lemon Squeezy is our Merchant of Record: it is the seller for your subscription, it issues the invoice, and it collects and remits the applicable tax. That is a commercial and tax arrangement, not a data-protection one.
For payment data, Lemon Squeezy decides its own purposes and means, which makes it an independent controller rather than our processor. Its own privacy terms govern that data. We list it here anyway, because you deserve to know who receives what — not because it processes data on our instructions.
Card details never reach us. We store only a plan status and non-sensitive references.
When this list changes
We will give at least 30 days’ notice before we add or replace a sub-processor. If you have an account with us, that notice goes to your account email.
You may object on reasonable grounds relating to data protection. We will work with you to find an alternative; if we cannot, you may terminate the affected subscription without penalty and receive a refund of any prepaid, unused period.
What is not on this list, and why
Some things you might expect to see here are absent on purpose:
- Analytics. We run our own statistics infrastructure rather than sending your visitors to a third-party analytics service, so there is no analytics sub-processor to name.
- Advertising and tracking networks. We do not use advertising cookies and do not track your visitors across other websites.
Consent-gated analytics tools are not currently deployed. If that ever changes, they would appear on this list before they were switched on.
Contact
Questions about this list, or a request for the notice email when it changes: [email protected].