Draft, not yet in force
This document has not been reviewed by a lawyer and does not bind anyone yet. It is published here so it can be read and corrected before launch. Do not rely on it.
Subprocessors
Last updated 16 September 2026
These are every third party that processes data on our behalf. The list is short on purpose. Each one is under a contract that requires it to protect the data and to process it only on our instructions.
1.Current subprocessors
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| Vercel | Application hosting, the redirect edge network, DNS, custom domains, bot filtering, and cookieless web analytics | Everything in transit: account data, QR codes, destinations, and scan requests. Country and city for a scan are derived from Vercel’s network-level geolocation. | United States |
| Neon | Managed PostgreSQL, the primary database | Account records, workspaces, campaigns, QR codes and destinations, scan records, and received role-address email | United States |
| Stripe, including Link | Payments and subscriptions, as merchant of record | Your name, email, billing address, payment details, and purchase history. Card details go to Stripe directly and never reach us. | United States |
| Resend | Transactional email out, and inbound mail to our role addresses | Your email address and the contents of the messages we send you, such as sign-in, billing, alert and digest email | United States |
| Google Cloud (Web Risk) | Checking whether a destination URL is known to be malicious, so an abusive code can be paused automatically | The destination URL of a QR code. No account data and no scanner data is sent. | United States |
| Google (Sign in with Google) | Optional third-party sign-in | Only for account holders who choose it: name, email address, and profile image | United States |
2.Changes to this list
We will give at least 30 days’ notice before a new subprocessor starts handling customer data, by email to account holders. If you object on reasonable data protection grounds, tell us and we will try to resolve it; if we cannot, you may cancel and we will refund the unused part of your term. This mirrors the data processing addendum.
Questions: support@keeperqr.com.