Sub-processors
Last updated: October 10, 2026
Transformination OÜ (CookieBoss) uses the service providers below to run CookieBoss. “Customer data” means data about our customers’ accounts. “Visitor data” means consent data about visitors to our customers’ websites, which we process on our customers’ behalf.
We will update this page at least 30 days before adding or replacing a sub-processor that handles visitor data, so customers can object. To be notified by email, write to [email protected].
| Sub-processor | What it does for us | Personal data it processes | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting and network (all CookieBoss services run on Cloudflare Workers), database (D1), file storage (R2) | Customer data and visitor data, including IP addresses in transit | Database primary location: Western Europe. Computing runs on Cloudflare’s global network and can take place outside the EU. |
| Stripe (Stripe Payments Europe Ltd. / Stripe, Inc.) | Payments, subscriptions and invoices | Customer data: email, name, billing details | EU and USA |
| Resend, Inc. | Sending transactional email (verification codes, password resets, billing notices) | Customer data: email address, name, email content | USA |
Transfers outside the EU/EEA rely on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework, as provided in each provider’s data processing terms.