Sub-processors

Entity

Vercel Inc. (États-Unis / United States)

Purpose

Application hosting, server functions, content delivery network (CDN).

Data

All requests in transit, including tracker hits (IP address in memory only), short-lived technical logs.

Location

Functions in Dublin, Ireland (dub1 region); global CDN.

Safeguards

Vercel data processing addendum, European Commission standard contractual clauses (SCCs), EU-U.S. Data Privacy Framework certification.

When

Always.

Visitor data

Yes (as a sub-processor)

Entity

Supabase Pte. Ltd. (Singapour / Singapore) — infrastructure Amazon Web Services

Purpose

Managed PostgreSQL database: accounts, configuration and statistics.

Data

Account data and audience data of customers’ sites (never IP addresses).

Location

European Union: AWS eu-west-1, Ireland.

Safeguards

Supabase DPA including the SCCs (Decision 2021/914) for support access from outside the EU; encryption at rest and in transit.

When

Always.

Visitor data

Yes (as a sub-processor)

Entity

Polar Software Inc. (États-Unis / United States)

Purpose

Subscription payments as reseller (Merchant of Record): checkout, invoicing, VAT.

Data

Paying customers’ name, e-mail, country, billing and payment data. No visitor data.

Location

United States.

Safeguards

European Commission SCCs. Polar is a controller for the sale it concludes with you.

When

Only if you subscribe to a paid plan.

Visitor data

No

Entity

Google Ireland Limited (Irlande / Ireland) — Google LLC (États-Unis / United States)

Purpose

Sign-in with Google (“Continue with Google”).

Data

Google account identifier, name and verified e-mail address sent to Globatics at sign-in.

Location

European Union and United States.

Safeguards

Google acts as an independent controller of your Google account; Google LLC is certified under the EU-U.S. Data Privacy Framework.

When

Only if you use sign-in with Google.

Visitor data

No

Entity

Anthropic Ireland, Limited (Irlande / Ireland) — Anthropic, PBC (États-Unis / United States)

Purpose

“Ask Globatics” analysis assistant powered by Claude.

Data

Your question and aggregated statistics (counts, pages, sources). Never IP addresses, visitor ids or individual records.

Location

United States.

Safeguards

Anthropic commercial terms and DPA (SCCs); no model training on submitted content.

When

Only when the AI assistant is enabled and you ask it a question.

Visitor data

No

Our servers also query the following services. They receive no personal data; we list them for transparency.

Entity

Have I Been Pwned — Superlative Enterprises Pty Ltd (Australie / Australia)

Purpose

Reject, at sign-up and on password change, passwords already published in data breaches.

What is sent

The first 5 characters of the password’s SHA-1 hash (“k-anonymity”), from our servers. Never the password, your e-mail or your IP address.

Entity

DuckDuckGo — Duck Duck Go, Inc. (États-Unis / United States)

Purpose

Find a site’s logo (yours or a referring site) when the site itself provides none.

What is sent

A domain name (e.g. news.ycombinator.com), from our servers. Never a visitor, an IP address, a visit time or the site that received the traffic.

Entity

Google (favicons) — Google LLC (États-Unis / United States)

Purpose

Second fallback to find a site’s logo, when DuckDuckGo has none.

What is sent

A domain name, from our servers, on the same terms.

• Logos are first looked up on the site itself (home page, favicon.ico), then cached for 14 days (1 day when there is none); expired entries are erased within 30 days.
• A site’s connection test only queries that site, at your request.
• Alerts, webhooks, exports and the API only send data to destinations you configure yourself.

Account holders are notified by e-mail. For any question or objection: privacy@globatics.live. Audience data is hosted in the European Union (Ireland).