Sub-processors
Last updated: October 19, 2026
These are the companies that process personal data for us to run the hosted OpenPartner service and the OpenPartner Network. Each one may use the data only to provide its service to us, under written terms that protect it. Our Privacy Policy explains what we collect and why.
| Sub-processor | What for | Personal data | Location |
|---|---|---|---|
| DigitalOcean, LLC | Hosting: application servers, databases, file storage, backups and server logs | All data in the service | United States (New York) |
| Cloudflare, Inc. | Network edge in front of our hosting provider (content delivery and traffic protection) | Requests in transit, including IP addresses and browser details | Global edge network; US company |
| Stripe, Inc. | Subscription billing, usage fees, Stripe Connect payouts and the Stripe App connection | Billing contacts and payment details; partner email addresses and payout amounts for Stripe Connect | United States and other countries where Stripe operates |
| Postmark (ActiveCampaign, LLC) | Transactional email: sign-in links, notifications, application updates | Recipient names and email addresses, email content | United States |
| PostHog, Inc. | Product analytics in the dashboards, and on openpartner.dev with your consent | Pages viewed and interactions, browser and device details, approximate location, a random identifier | United States |
| Google LLC (YouTube Data API) | Network only: verifying a creator’s YouTube channel, at the creator’s request | The channel handle or ID the creator gives us | United States |
Not on this list
- Services you connect yourself. Your own mail server, webhook endpoints, partner postback URLs and other integrations receive data because you or your partners set them up. They work for you, not for us.
- Self-hosted OpenPartner. A self-hosted instance uses whatever providers its operator chooses. If it connects to the Network, the Network's sub-processors above apply to what it sends there.
- Google, as a sign-in provider. When you choose "Continue with Google," you sign in to Google directly and Google tells us your verified email address. We don't send Google data to process for us, so it isn't our sub-processor: it acts as an independent controller of your Google account, under the Google Privacy Policy. See Signing in with Google. (Google's YouTube Data API, listed above, is different: there we do send it a channel handle to check.)
Changes to this list
We'll update this page and email the account owner of every hosted account at least 30 days before a new sub-processor starts processing Customer Data, or before we replace one. If you object on reasonable data-protection grounds, tell us at [email protected] within those 30 days and we'll work with you to find a solution. If we can't, you can close your account before the change takes effect, and we'll refund any fees you prepaid for the time after it closes.
If we ever have to replace a sub-processor urgently, for example because it fails or stops offering its service, we'll tell you as soon as we can, and the same right to object applies.
Contact
Questions about our sub-processors, or a copy of our Data Processing Addendum: [email protected].