Subprocessors
Every company that can see personal data held by the Platform, what reaches each one, and where they are.
Contents · 4 sections
Plain-language overview. Running a website means other companies hold pieces of it: the servers, the database, the thing that sends email. Each one that can see personal data is named below with what reaches it. There is no payment processor on the list, because nothing here takes a payment, and no advertising or analytics company, because there are none anywhere on this site.
Summary only. The numbered sections below are the document.
The list
Each of these companies can see some part of the personal data described in the Privacy Policy. Each processes under contract, on our instructions, and none uses it for anything of their own.
| Company | What they do | What reaches them | Where |
|---|---|---|---|
| Vercel | Application hosting, and the bot screening in front of formsAlso the host, so it sees traffic that never reaches a database. | Every request to the site, which means an IP address and a browser user-agent string. The bot screening can set a first-party cookie to tell a browser from a script. | United States |
| Neon | The Postgres database | Everything the Platform stores: your account, your inquiries and their threads, proposals, tickets and the logs described in the Privacy Policy. | United States |
| Cloudflare | Object storage (R2), where it is configured | Files held by the Platform, and nothing about who uploaded them. | United States |
| Twilio SendGrid | Sending service email | Your email address and the body of the message, which can carry your name and an inquiry, proposal or ticket code. Click and open tracking is off, so it reports delivery and bounces and nothing about what you opened. | United States |
| Resend | Sending service email, on deployments configured for it | The same as SendGrid. A deployment uses one provider or the other, never both. | United States |
| Anthropic | Running the AI design engine inside our CAD tooling | The text of a prompt and our instructions to the model. No geometry, no project, no account identity and no email address. | United States |
| RunPod | Renting GPUs for our machine-learning work | A training job and the data set it runs on. Those data sets are imagery we own, and they hold no customer personal data. | United States |
How this list changes
A company reaches this page in the same change that connects it to the code. That is enforced rather than remembered: a check renders this list, reads every third-party address the application can reach, and fails the build on one that no row here accounts for.
- Before it goes live. A vendor being integrated is declared in the register with its processing switched off, so it cannot be described here as handling anything.
- When it does. The row appears in the table above and the effective date on this page moves.
- If you have an engagement with us and object. Write to support@spaltx.com with SUBPROCESSOR in the subject and tell us which one. We will tell you what it would mean for the work.
What is not on this list
Two absences are worth naming, because a reader who assumes them will assume wrong in one direction or the other.
- No payment processor. Nothing on this site takes a payment, so no card network, gateway or acquirer sees anything here.
- No advertising or analytics vendor. Not one, on any page. The Cookie Policy is the detail.
The people who read those are our own, not a vendor’s. Where a project genuinely needs a third party to see client material we ask you first, in writing, and it is named in the proposal for that work rather than added to this page.
Transfers and safeguards
Every company above holds data in the United States, and SpaltX operates from there. For a reader in the EEA, the UK or Switzerland that is a transfer, and the Privacy Policy says which safeguard we rely on and what we have not done.
Ask us at support@spaltx.com and we will tell you which safeguard covers a particular vendor.