Subprocessors
Version 2026-10-30.1, effective 31 October 2026.
The service providers below process personal data for us, for the shop, the Sites and the customer account. The Spitfire software you install sends none of your test data to us or to them. We announce a new provider here before it starts processing data.
| Provider | Location | Purpose | Data |
|---|---|---|---|
| Hosting: netcup GmbH, Almanya | Server location as named | Runs the server of the shop, the customer account and the forms | Order, account and form data; operation logs |
| Cloudflare, Inc. | United States (global network) | Serves the Sites securely (CDN, protection against attacks), where used, e-mail routing for our addresses and, only with consent, visit statistics | IP address and request details of visitors; e-mails sent to our addresses |
| Twilio Inc. (SendGrid) | United States | Sends order, license, sign-in and notice e-mails | Name, e-mail address, order details |
| PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. | Türkiye | Takes and refunds card payments | Name, e-mail, phone, billing address, amount; card details are entered on PayTR's page |
| Paraşüt | Türkiye | Issues e-invoices and e-Arşiv invoices, when automatic invoicing is on | Invoice details: name or company, address, tax or VAT ID, order lines |
| İleti Merkezi | Türkiye | Sends SMS, only to people who consented to campaign SMS | Mobile number, message text |
| Slack Technologies, LLC | United States | Instant notices to our team about orders, form requests and errors | Name, e-mail, company, order number, error details; never card details or license keys |
| Telegram Messenger Inc. | United Arab Emirates | The same notices, for warnings and critical errors only | As for Slack |
When you choose to sign in with Google, GitHub or Microsoft, that provider acts as an independent controller under its own privacy policy; it is not our subprocessor.
The European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework cover transfers to providers outside the EEA, as the GDPR privacy notice says. Questions: contact@usespitfire.com.