Draft under legal review, not yet in force.
Sub-processors — SFT Visitor Journeys
This is an engineering-drafted list of the third parties SFT Visitor Journeys actually sends data to, prepared for legal review, not a finished legal document. It states no facts beyond what the system actually does, and marks anything not yet decided as TBD rather than guessing.
A sub-processor is a third party that processes personal data on Smooth Flow Tech’s behalf, as processor, on the customer’s (controller’s) instructions. This list is the source both our Data Processing Agreement and any customer-facing sub-processor disclosure should draw from — it should never diverge from it.
Visitor data (the customer is controller; Smooth Flow Tech is processor)
| Sub-processor | Role | Location | Data involved |
|---|---|---|---|
| Hostinger | Hosts the VPS that runs the app, the database (PostgreSQL) and the analytics store (ClickHouse) | EU data centre (preferred: Germany, with Lithuania, the Netherlands and France as other EU options — TBD, confirm the exact data centre at order and record it here before the first customer) | All visitor data described in our Data Processing Agreement §“Categories of Personal Data”, for as long as it is retained (§“Retention”) |
| Off-VPS backup storage | Stores the encrypted off-site copy of the nightly backups | TBD — Hetzner Object Storage (Germany) or Scaleway Object Storage (France), both EU. Backups are encrypted before they leave the VPS. | The same data as above, for the backup retention period stated in the DPA (each backup 14 days) |
| Sentry (Functional Software, Inc.) | Error tracking for the app’s server: when a request fails, the error is reported so we can fix it | EU data region (Germany). The company is in the US: TBD, legal to confirm the transfer basis (EU–US Data Privacy Framework or SCCs in Sentry’s DPA). | The error message, stack trace, route and method. The app is configured to send no request headers, cookies, bodies, query strings, user details or variable values; an error message can occasionally contain a value from the failed request. Kept for Sentry’s error retention (90 days on the current plan, TBD to confirm). |
No other third party receives visitor data. In particular:
- Google is not a sub-processor. When a visitor clicks a Google Ad, their browser calls our redirect endpoint directly, on the customer’s own instruction (the tracking template the customer configured in their own Google Ads account) — Smooth Flow Tech does not send anything to Google.
- The tracker never loads any third-party script, font, or resource of its own.
Account and billing data (Smooth Flow Tech is controller)
This data — the customer’s own account, contact details, invoices and payment information — is processed by Smooth Flow Tech as controller, not on the customer’s instructions, so it sits outside the DPA’s scope. Listed here for completeness and transparency:
| Sub-processor | Role | Location | Data involved |
|---|---|---|---|
| Stripe | Payment processing, invoicing, tax calculation and collection (Stripe Tax) | Stripe is its own controller for payment data under its own privacy policy | Billing contact name, e-mail, address, tax ID, payment method, transaction history |
| Hostinger (Mail) | Sends account e-mail (verification, password reset, billing notices) from no-reply@smoothflowtech.com |
EU (Hostinger e-mail hosting) | Recipient e-mail address, e-mail content |
| Hostinger | Hosts the account database (the same Postgres instance as above) | Same as above | Account data: organization, user, membership rows |
Keeping this list current
Whenever a new sub-processor is added, changed, or removed for visitor data, this page, our Data Processing Agreement’s technical-measures annex, and whatever notice mechanism the Terms of Service promise to customers, must all be updated together.