1. Current sub-processors
These services receive personal data that we process for our customers: the visitors of their sites, and the data about their own users in the workspace.
- Service
- Hetzner Online GmbH
- Purpose
- The dedicated server that runs the app, the API, ingest and both databases.
- Personal data it receives
- All of it: workspace data and every event.
- Location
- Helsinki, Finland (EU)
- Service
- Cloudflare, Inc.
- Purpose
- DNS and the network in front of app.highseat.com and cdn.highseat.com. Stores the daily database backups and export files (R2).
- Personal data it receives
- Every request passes through it, with the IP address and user agent. Backups and exports hold the stored events.
- Location
- Global network. R2 storage in Western Europe
- Service
- Better Stack
- Purpose
- Request traces and error reports for the API.
- Personal data it receives
- The request method, route and status, the URL with tokens removed, error details, and workspace or site ids. No IP address and no user agent.
- Location
- Frankfurt, Germany (EU)
| Service | Purpose | Personal data it receives | Location |
|---|---|---|---|
| Hetzner Online GmbH | The dedicated server that runs the app, the API, ingest and both databases. | All of it: workspace data and every event. | Helsinki, Finland (EU) |
| Cloudflare, Inc. | DNS and the network in front of app.highseat.com and cdn.highseat.com. Stores the daily database backups and export files (R2). | Every request passes through it, with the IP address and user agent. Backups and exports hold the stored events. | Global network. R2 storage in Western Europe |
| Better Stack | Request traces and error reports for the API. | The request method, route and status, the URL with tokens removed, error details, and workspace or site ids. No IP address and no user agent. | Frankfurt, Germany (EU) |
2. Services we use for our own account and billing data
These services handle data we control ourselves: the billing and email details of account holders, and the readers of this website and the documentation. They are not sub-processors. The privacy policy explains how we handle that data.
- Service
- Stripe
- Purpose
- Subscriptions and payments. Sends receipts, failed-payment, expiring-card and renewal emails.
- Personal data it receives
- Account holders who pay: name, email, billing address, VAT number and card details. Card details go to Stripe only.
- Location
- Stripe Payments Europe, Limited, Ireland (EU), with processing in the United States
- Service
- Resend
- Purpose
- Sends the app's emails from mail.highseat.com: sign-in, invitations, trial, usage and deletion notices.
- Personal data it receives
- Account holders and invitees: email address, name and the email's content.
- Location
- Sent from Ireland (EU). Resend, Inc. is in the United States
- Service
- Mintlify
- Purpose
- Hosts the documentation at highseat.com/docs.
- Personal data it receives
- Readers of the documentation: the request, with its IP address and user agent.
- Location
- United States
- Service
- Cloudflare, Inc.
- Purpose
- Hosts this website, and stores profile photos (R2).
- Personal data it receives
- Readers of this website: the request, with its IP address and user agent. Account holders: their profile photo.
- Location
- Global network. R2 storage in Western Europe
| Service | Purpose | Personal data it receives | Location |
|---|---|---|---|
| Stripe | Subscriptions and payments. Sends receipts, failed-payment, expiring-card and renewal emails. | Account holders who pay: name, email, billing address, VAT number and card details. Card details go to Stripe only. | Stripe Payments Europe, Limited, Ireland (EU), with processing in the United States |
| Resend | Sends the app's emails from mail.highseat.com: sign-in, invitations, trial, usage and deletion notices. | Account holders and invitees: email address, name and the email's content. | Sent from Ireland (EU). Resend, Inc. is in the United States |
| Mintlify | Hosts the documentation at highseat.com/docs. | Readers of the documentation: the request, with its IP address and user agent. | United States |
| Cloudflare, Inc. | Hosts this website, and stores profile photos (R2). | Readers of this website: the request, with its IP address and user agent. Account holders: their profile photo. | Global network. R2 storage in Western Europe |
3. Services that receive no personal data
These services are part of how we run, but receive nothing that identifies a person:
- MaxMind GeoLite2: a location database we download and read on our own server. No request leaves the server.
- Google's favicon service: fetches the icon of a website by its host name, from our server, so a dashboard viewer's browser never contacts Google.
- The European Central Bank's daily exchange rates, through Frankfurter: read by our server to convert revenue into one currency.
- GitHub Container Registry: holds the app's build. It holds no customer data.
4. Services you choose
Some services receive data only because a customer or a user chooses them. Each acts under its own terms with that person:
- Google and GitHub, when you sign in with them.
- A payment provider, such as Stripe or Polar, that a customer connects to report revenue. It sends us sale records from the customer's own account.
- A first-party proxy that a customer runs on their own domain. Events pass through the customer's own server or worker before they reach us.
5. Changes
We email the owners of every workspace about each intended addition or replacement on the sub-processor list, 14 days before it takes effect, and update this page. When a sub-processor fails, suffers a security incident, or has to be replaced to keep the service secure or running, we may engage the replacement at once and tell you as soon as possible, and within 72 hours of the switch. Your right to object and what follows from it are set out in the data processing agreement.
This notice covers the sub-processor list only. The services we use for our own account and billing data change without notice, through an update to the privacy policy.
Questions: support@highseat.com.
Change log
- 19 October 2026: first publication of this list.