Subprocessors and Service Providers

DocInfra uses the following providers to run the Service. Each one processes only the data that its function needs. Locations describe where the processing takes place today; several providers operate globally. Changes to this list that affect customer content are announced on this page at least 15 days in advance, as described in the Data Processing Addendum.

Cloudflare, Inc. (United States, global network)

Function	What it processes
Pages	Hosting of the website and the dashboard (static files).
Tunnel	Network edge in front of the API and the authentication server; sees request metadata and the client IP address.
R2	Object storage for documents submitted for conversion or document rewrite, and their results, until deletion (24 hours, lifecycle 2 days).
Workers AI and AI Gateway	Runs the language model that rewrites text. Receives the text of each rewrite request and returns the result. AI Gateway runs with payload collection disabled, so it keeps metadata, not text. Cloudflare states that Customer Content is not used to train its models without explicit consent.
Turnstile	Bot protection on the Humanizer and the support form. Receives the technical signals needed to distinguish people from bots.
Web Analytics	Privacy-oriented measurement of website visits, without cookies or fingerprinting.

International processing: yes. Terms: cloudflare.com/privacypolicy/ and cloudflare.com/cloudflare-customer-dpa/.

Contabo GmbH (Germany; server located in the United States, US-East)

Hosting of the virtual server that runs the API, the worker, the database, the queue, the cache and the authentication server. Contabo provides the infrastructure and does not access the data stored on it in normal operation; it may access the server for support or legal reasons under its terms.

International processing: yes. Terms: contabo.com/en/legal/privacy/.

Resend, Inc. (United States)

Transactional email: account verification, password reset, support case confirmations and status notices. Receives the recipient address, the subject and the body of each message.

International processing: yes. Terms: resend.com/legal/privacy-policy and resend.com/legal/dpa.

Lemon Squeezy, LLC (United States)

Merchant of Record for paid plans: checkout, payment processing, taxes, receipts and invoices, subscription management and refunds. Receives the buyer’s name, email address, billing address, tax information where applicable and payment details. For that information Lemon Squeezy acts under its own obligations as merchant of record and as an independent controller, not only as our processor. DocInfra receives from it the subscription status, the identifiers it assigns and the events of the subscription; card numbers never reach DocInfra.

International processing: yes. Terms: lemonsqueezy.com/privacy and lemonsqueezy.com/dpa.

Google LLC (United States)

Only if you choose to sign in with Google. Google authenticates you and gives us your email address, name and a technical identifier. Google acts under its own privacy policy for the Google account itself.

International processing: yes. Terms: policies.google.com/privacy.

What is not a third party

The authentication server (Keycloak), the database (PostgreSQL), the queue (Apache ActiveMQ Artemis), the cache (Redis), the malware scanner (ClamAV) and the conversion engines (Gotenberg, LibreOffice, Chromium) are software run by DocInfra on its own server. They are not subprocessors.