Cookiesh uses a small number of carefully chosen service providers (“sub-processors”) to run its service. This page lists every sub-processor that may process personal data that our customers entrust to us, as described in our Data Processing Agreement.
Current sub-processors
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Hosting of the Cookiesh platform and storage of consent records | Consent records, account data | Frankfurt, Germany (EU) |
| Cloudflare, Inc. | Content delivery network for the consent script, region detection and DDoS protection | IP address (processed in memory, not stored), request metadata | Global edge network; logs in the EU |
| Stripe Payments Europe, Ltd. | Payment processing for paid plans | Billing contact details, payment details | Ireland (EU), United States |
| Postmark (ActiveCampaign, LLC) | Transactional email, such as sign-in links, usage alerts and invoices | Name, email address, email content | United States |
| Help Scout, Inc. | Customer support inbox | Name, email address, support messages | United States |
Consent records collected on your websites are stored only with Amazon Web Services in the EU. The providers in the United States process account and billing data, not consent records. Transfers to them are covered by the EU-US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.
How we choose sub-processors
Before we share personal data with a provider, we review its security practices and data protection terms. We sign a data processing agreement with each one that is at least as protective as our own DPA. We give each provider access only to the data it needs for its purpose.
Changes to this list
We notify customers at least 30 days before we add or replace a sub-processor. We send the notice by email to account owners, and we update this page and its “last updated” date at the same time.
To receive these notices even if you are not an account owner, email privacy@cookiesh.eu with the subject “Sub-processor updates”.
If you object to a new sub-processor on reasonable data protection grounds, tell us within the notice period. The DPA describes what happens next.
Contact
Questions about our sub-processors: privacy@cookiesh.eu.