# Flusterduck Subprocessors

Canonical: https://flusterduck.com/subprocessors
Effective date: July 4, 2026 · Last updated: July 11, 2026

This is a faithful markdown summary of the Subprocessors page; the canonical HTML page above is the authoritative text.

## Roles

For behavioral telemetry collected from your sites' visitors, you are the data controller and Flusterduck (operated by Creayo LLC) acts as your data processor. For your account, organization, and billing data, Flusterduck is the controller. Each subprocessor below processes data only on our documented instructions, only as needed to provide its service to us, and under a written agreement imposing data-protection obligations consistent with ours.

The baseline before any subprocessor is involved: short element labels and customer-provided event metadata go through browser-side PII redaction before they leave. No provider on this list receives form values, keystrokes, or session recordings, because we never collect them. Visitor IP addresses are hashed at the edge before storage.

## Infrastructure subprocessors

| Subprocessor | Purpose of processing | Categories of data | Data subjects | Location |
| --- | --- | --- | --- | --- |
| Supabase, Inc. (hosted on Amazon Web Services, Inc.) | Database, authentication, and edge-function compute. The core of the service runs here. | All service data: behavioral events, detected issues, page snapshots, account and organization records. | Site visitors (pseudonymous), account members | United States |
| Vercel Inc. | Hosts flusterduck.com and the API proxy; dashboard and SDK traffic transits its edge network. | Request traffic in transit, including SDK event payloads and dashboard sessions. | Site visitors (pseudonymous), account members | United States (global edge) |
| Cloudflare, Inc. | Hosts the MCP server (mcp.flusterduck.com) for AI-assistant access to your data. | MCP requests and responses for accounts that use the MCP integration. | Account members | United States (global edge) |
| Anthropic, PBC | AI models behind issue diagnosis, triage, Guide answers, and Autofix. | Structured issue evidence, PII-redacted element labels, error summaries, and bounded public page content. No form values or user-typed text. | Site visitors (pseudonymous) | United States |
| context.dev | Fetches rendered snapshots of your public pages to ground AI diagnosis and power the site scanner. | Public page URLs and the rendered content retrieved from them. No visitor-session or Flusterduck account data. | People whose information appears on a public page, if any | United States |
| Stripe, Inc. | Billing: subscriptions, payment methods, and invoices. | Account holder name, email, and payment details. Stripe acts as an independent controller for payment data; card numbers never touch our systems. | Account holders | United States (global) |
| Resend | Transactional email: alerts, weekly digests, and onboarding messages. | Member names and email addresses, plus the content of the notification. | Account members | United States |

Trade names are used where a provider does not prominently publish its legal entity name. Providers may replicate or route traffic through other regions via their own networks; primary processing locations are listed above. One client-side note for completeness: the dashboard and scan results load site favicons directly from Google's public favicon service in your browser. Only the site's domain name reaches Google, never account or visitor data.

## Advertising measurement

We run advertising measurement on public marketing pages and at the moment a card-backed trial or paid plan is confirmed. It does not track ordinary dashboard navigation. Confirmation events send the plan, the list price for paid events, and a stable checkout or billing-attempt event ID so repeat responses count once. Our event payload has no name, email address, account ID, or Flusterduck visitor ID. X and Google may set or read their own advertising cookies.

| Subprocessor | Purpose of processing | Categories of data | Data subjects | Location |
| --- | --- | --- | --- | --- |
| X Corp. (X Ads / Twitter) | Advertising conversion measurement. Loaded on our public marketing pages and when a paid plan is confirmed after checkout or an in-product billing action. It does not track ordinary dashboard navigation. | A paid conversion event with the plan name, list price, and a stable checkout or billing-attempt event ID for deduplication. Our event payload has no name, email address, account ID, or Flusterduck visitor ID. X may set or read its own advertising cookies. | Prospective customers who reach our marketing site or complete checkout | United States |
| Google LLC (Google Ads) | Advertising conversion measurement. Loaded on our public marketing pages and when a card-backed trial or paid plan is confirmed. It does not track ordinary dashboard navigation. | Marketing-site page views, a zero-value trial event, or a paid event with the plan name and list price. Confirmation events include a stable checkout or billing-attempt event ID for deduplication. Our event payload has no name, email address, account ID, or Flusterduck visitor ID. Google may set or read its own advertising cookies. | Prospective customers who reach our marketing site or complete checkout | United States (global) |

## International transfers

Where personal data originating from the EEA, the United Kingdom, or Switzerland is transferred to the providers above, the transfer relies on the EU-US Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified, and on Standard Contractual Clauses otherwise, together with the technical measures described in the privacy policy: in-browser PII redaction, IP hashing, and encryption in transit and at rest.

## Integrations you connect

These receive data only if you connect them, only what you direct us to send, and stop receiving anything the moment you disconnect them. They act as your directly appointed processors (or independent controllers) rather than our subprocessors:

- Linear: issue titles, summaries, and status sync.
- GitHub: issue exports and Autofix draft pull requests.
- Slack: alert notifications and slash-command responses.
- PagerDuty: alert escalations.

## Notice of changes and right to object

We update the canonical page before engaging a new infrastructure subprocessor or replacing an existing one, and we give organization owners at least 30 days' advance notice through the dashboard and by email, except where an urgent replacement is required to protect the security or availability of the service, in which case we notify you as soon as reasonably possible.

If you object to a new subprocessor on reasonable data-protection grounds, contact support@flusterduck.app within the notice period. We will work with you in good faith to address the objection, for example by adjusting configuration so the subprocessor is not used for your data where the product allows it. If no resolution is reasonably possible, you may terminate the affected service and we will refund any prepaid fees covering the remainder of the term.

## Data processing agreement

A data processing agreement incorporating these subprocessor terms and Standard Contractual Clauses is available on request at support@flusterduck.app. See also the privacy policy (https://flusterduck.com/privacy, twin /privacy.md) and terms of service (https://flusterduck.com/terms, twin /terms.md).