This list is section 7.1 of our Privacy Policy; section numbers below refer to the Privacy Policy.
The vendors below process personal data on our behalf under written contracts that require confidentiality, security measures and data-protection terms (including Standard Contractual Clauses where data leaves the EU/UK). The current list is maintained at urlcrop.com/legal/sub-processors; customers can subscribe to change notifications there.
| Vendor | What it does for us | Data involved | Location of processing |
|---|---|---|---|
| Contabo GmbH | Server hosting of our application, databases (PostgreSQL, Redis) and analytics, including the redirect service, files (invoices, QR assets, exports) and raw event archives | All account, workspace and analytics data at rest | Mumbai, India data centre (provider headquartered in Germany) |
| Contabo Object Storage (Contabo GmbH) | Off-site storage of encrypted backups. Backups are encrypted on our server before upload, so the storage holds ciphertext only and cannot read it | Encrypted database and file backups | Singapore (only ciphertext leaves India) |
| Cloudflare, Inc. | For our own hostnames only (urlcrop.com, app.urlcrop.com, api.urlcrop.com, admin.urlcrop.com, crop.sh): DNS, reverse proxy and content delivery, DDoS protection and web application firewall, country lookup, Turnstile bot checks on public forms, Access (protects our internal admin console), and Email Routing (forwards mail sent to support@urlcrop.com and business@urlcrop.com to our mailbox). Traffic to customers' own custom domains goes directly to our servers and does not pass through Cloudflare. | Request metadata in transit (IP address, user agent, URL, headers) for proxied hostnames; emails sent to our support and business addresses | Cloudflare's global network: the data centre nearest to the visitor (any country where Cloudflare operates); company based in the United States |
| Internet Security Research Group (Let's Encrypt) | Issues TLS (HTTPS) certificates for customers' custom domains | The customer's domain name only, which is shared for issuance and recorded in public certificate transparency logs; no End User or account data | United States |
| MaxMind, Inc. (GeoLite2) | Supplies the IP-geolocation database that we download and run locally on our servers. No data is sent to MaxMind. Listed for transparency; MaxMind does not process personal data for us. This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com. | None (database is used offline) | — |
| Resend, Inc. | Transactional and opted-in lifecycle email delivery | Email address, name, email content (invoices, alerts) | United States |
| MSG91 (Walkover Web Solutions Pvt Ltd) | SMS and WhatsApp one-time passwords for phone verification and 2FA | Mobile number, OTP message | India |
| PostHog, Inc. | Product analytics and feature flags | Pseudonymous usage events, account ID, with consent where required | European Union (Frankfurt), to be confirmed |
| Google LLC (Google Analytics) | Website analytics for urlcrop.com (marketing site only) | Pseudonymous identifier, pages visited, approximate location derived from IP address (Google does not log or store the IP address), device and browser type; with consent where required | United States |
| Functional Software, Inc. (Sentry) | Error and performance monitoring | Error reports that may include account ID, request ID, IP address, URL | European Union or United States, to be confirmed |
| Better Stack, Inc. | Log management, server metrics, uptime monitoring, status.urlcrop.com | Application logs (30-day retention), status-page subscriber emails | European Union, to be confirmed |
| Razorpay Software Pvt Ltd | Payments for customers billed in India; partner payouts in India (RazorpayX) | Name, email, phone, billing address, payment instrument details (held by Razorpay), transaction data; partner bank/UPI and KYC data | India |
| PayPal Pte. Ltd. / PayPal, Inc. | Payments for customers billed outside India; international partner payouts | Name, email, billing country, PayPal account identifiers, transaction data | United States and other PayPal locations (global) |
| Google LLC (Web Risk API) | Checks destination URLs against Google's unsafe-site lists | Destination URLs only — no End User or account personal data is sent | United States / global |
| WorkOS, Inc. (Enterprise only) | Single sign-on (SAML/OIDC) and user provisioning (SCIM) | Name, email, group membership and identity provider attributes of Enterprise users | United States |
| Wise Payments Ltd (Phase 3 fallback) | International partner payouts if PayPal Payouts is unavailable | Partner name, bank details, amount | United Kingdom / global |
Not sub-processors. URLhaus (abuse.ch) and PhishTank are threat feeds we download; we send them nothing. GitHub (code and container images) and Bitwarden (internal credential vault) hold no customer personal data.
QalbIT Infotech Pvt Ltd. Questions about this document: business@urlcrop.com.