Legal
Subprocessors
Effective date: July 4, 2026 · Last updated: August 11, 2026
Roles
For behavioral telemetry collected from your sites' visitors, you are the data controller and Flusterduck (operated by Creayo LLC) acts as your data processor. For your account, organization, and billing data, Flusterduck is the controller. The providers below are the subprocessors we engage to deliver the service; each processes data only on our documented instructions, only as needed to provide its service to us, and under a written agreement imposing data-protection obligations consistent with ours.
The baseline that applies before any subprocessor is involved: short element labels and customer-provided event metadata go through browser-side PII redaction before they leave. No provider on this list receives form values, keystrokes, or session recordings, because we never collect them. Visitor IP addresses are hashed at the edge before storage.
Infrastructure subprocessors
| Subprocessor | Purpose of processing | Categories of data | Data subjects | Location |
|---|---|---|---|---|
| Supabase, Inc. (hosted on Amazon Web Services, Inc.) | Database, authentication, and edge-function compute. The core of the service runs here. | All service data: behavioral events, detected issues, page snapshots, account and organization records. | Site visitors (pseudonymous), account members | United States |
| Vercel Inc. | Hosts flusterduck.com and the API proxy; dashboard and SDK traffic transits its edge network. | Request traffic in transit, including SDK event payloads and dashboard sessions. | Site visitors (pseudonymous), account members | United States (global edge) |
| Cloudflare, Inc. | Hosts the MCP server and the isolated browser worker used for public-page site checks. | MCP requests and responses for accounts that use the MCP integration. For a public-page browser check, the configured public URL and what a logged-out browser observes there. No visitor-session data, form values, or user-typed text. | Account members; people whose information appears on a public page, if any | United States (global edge) |
| Anthropic, PBC | AI models behind issue diagnosis, triage, Guide answers, and Autofix. | Structured issue evidence, PII-redacted element labels, error summaries, bounded public page content, and up to four fresh public-page screenshot images in an AI-detection investigation. No visitor-entered form values or visitor-typed text; a public screenshot may include any default or prefilled value visible to a logged-out visitor. | Site visitors (pseudonymous), account members, and people whose information appears on a public page, if any | United States |
| context.dev | Fetches rendered text and screenshots of your public pages to ground AI analysis, power page heatmaps, and run the site scanner. | Public page URLs and the rendered content or images retrieved from them. No visitor-session or Flusterduck account data. | People whose information appears on a public page, if any | United States |
| Stripe, Inc. | Billing: subscriptions, payment methods, and invoices. | Account holder name, email, and payment details. Stripe acts as an independent controller for payment data; card numbers never touch our systems. | Account holders | United States (global) |
| Resend | Transactional email: alerts, weekly digests, and onboarding messages. | Member names and email addresses, plus the content of the notification. | Account members | United States |
Trade names are used where a provider does not prominently publish its legal entity name; the full entity name appears in that provider's own terms. Providers may replicate or route traffic through other regions via their own networks; primary processing locations are listed above. One client-side note for completeness: the dashboard and scan results load site favicons directly from Google's public favicon service in your browser. Only the site's domain name reaches Google, never account or visitor data.
Advertising measurement
We run advertising measurement on public marketing pages and at the moment a card-backed trial or paid plan is confirmed. It does not track ordinary dashboard navigation. Confirmation events send the plan, the list price for paid events, and a stable checkout or billing-attempt event ID so repeat responses count once. Our event payload has no name, email address, account ID, or Flusterduck visitor ID. X and Google may set or read their own advertising cookies.
| Subprocessor | Purpose of processing | Categories of data | Data subjects | Location |
|---|---|---|---|---|
| X Corp. (X Ads / Twitter) | Advertising conversion measurement. Loaded on our public marketing pages and when a paid plan is confirmed after checkout or an in-product billing action. It does not track ordinary dashboard navigation. | A paid conversion event with the plan name, list price, and a stable checkout or billing-attempt event ID for deduplication. Our event payload has no name, email address, account ID, or Flusterduck visitor ID. X may set or read its own advertising cookies. | Prospective customers who reach our marketing site or complete checkout | United States |
| Google LLC (Google Ads) | Advertising conversion measurement. Loaded on our public marketing pages and when a card-backed trial or paid plan is confirmed. It does not track ordinary dashboard navigation. | Marketing-site page views, a zero-value trial event, or a paid event with the plan name and list price. Confirmation events include a stable checkout or billing-attempt event ID for deduplication. Our event payload has no name, email address, account ID, or Flusterduck visitor ID. Google may set or read its own advertising cookies. | Prospective customers who reach our marketing site or complete checkout | United States (global) |
International transfers
Where personal data originating from the European Economic Area, the United Kingdom, or Switzerland is transferred to the providers above, the transfer relies on the EU–US Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified, and on Standard Contractual Clauses otherwise, together with the technical measures described in our privacy policy: in-browser PII redaction, IP hashing, and encryption in transit and at rest.
Integrations you connect
The following receive data only if you connect them, only what you direct us to send, and stop receiving anything the moment you disconnect them. Because they process data on your instructions under your own agreements with them, they act as your directly appointed processors (or independent controllers) rather than our subprocessors:
- Linear: issue titles, summaries, and status sync.
- GitHub: issue exports and Autofix draft pull requests.
- Slack: alert notifications and slash-command responses.
- PagerDuty: alert escalations.
Notice of changes and right to object
We update this page before engaging a new infrastructure subprocessor or replacing an existing one, and we give organization owners at least 30 days' advance notice through the dashboard and by email, except where an urgent replacement is required to protect the security or availability of the service, in which case we notify you as soon as reasonably possible.
If you object to a new subprocessor on reasonable data-protection grounds, contact support@flusterduck.app within the notice period. We will work with you in good faith to address the objection, for example by adjusting configuration so the subprocessor is not used for your data where the product allows it (such as disabling page-content fetching in Settings → AI). If no resolution is reasonably possible, you may terminate the affected service and we will refund any prepaid fees covering the remainder of the term.
Data processing agreement
A data processing agreement incorporating these subprocessor terms and Standard Contractual Clauses is available to customers on request at support@flusterduck.app. See also the privacy policy and terms of service.