The third-party providers Onelo uses to process personal data on our customers’ behalf. Developers using Onelo are the data controllers; Onelo processes end-user data as their processor.
| Sub-processor | Purpose | Data categories | Region |
|---|---|---|---|
| Supabase | Database, authentication and storage infrastructure | Account data, end-user records, consent records | EU |
| Hetzner | Cloud hosting and compute (servers running Onelo) | All data processed by Onelo while in use | EU (Germany) |
| Stripe | Payment processing for developers’ end-user sales (Stripe Connect) | Payment and transaction data, billing country | EU / US (SCCs) |
| Lemon Squeezy | Merchant of record for Onelo’s own paid subscriptions, and referral tracking for Onelo’s affiliate programme | Onelo subscription billing data (customer email, payment status), referral identifier for visitors arriving via an affiliate link | US (SCCs) |
| Umami | Cookieless visit statistics for Onelo’s own public marketing pages (never end-user data) | IP address and user-agent in transit, stored only as anonymous aggregates | EU / US (SCCs) |
| Resend | Transactional email delivery | Email addresses, message content | US (SCCs) |
| Cloudflare | Bot protection (Turnstile) and content delivery | IP address, request metadata | Global (SCCs) |
| Google, GitHub, Apple | Social sign-in (OAuth), when a developer enables a provider | OAuth profile (email, provider account ID) | US (SCCs) |