Sub-processors
Effective date: August 10, 2026
Last updated: August 10, 2026
These are the third-party providers that process personal data on Markup's behalf, per section 3 of the Data Processing Agreement. The list is deliberately short, and the widget adds nothing to it on host pages — it talks only to the Markup backend.
Infrastructure (always active)
| Sub-processor | Entity | What it processes | Location |
|---|---|---|---|
| Convex | Convex, Inc. | The database, backend functions and file storage behind every project — all service data, including feedback content and screenshots | European Union (Ireland; US entity) |
| Cloudflare | Cloudflare, Inc. | Hosting and delivery of the dashboard's static pages; request logs (IP addresses) in the ordinary course of serving them | Global edge (US entity) |
| Google Ireland Ltd. | Sign-in for dashboard accounts (OAuth) — receives the fact that you signed in; provides us your name, email and avatar | EU / United States |
Product operations (always active)
| Sub-processor | Entity | What it processes | Location |
|---|---|---|---|
| PostHog | PostHog, Inc. | Product analytics: dashboard events keyed to account id and email with URLs masked to route patterns; widget usage counts keyed to projects with no person-level data | European Union (EU cloud) |
| Sentry | Functional Software, Inc. | Error reports: for dashboard errors, the reporting user's id and email; for widget errors, the project id and page origin only | United States |
| Resend | Resend, Inc. | Invitation emails: the invited address, the inviter's name and reply-to address, and the workspace and project names that appear in the message | United States |
Configured per project (active only if you enable it)
| Sub-processor | Entity | What it processes | Location |
|---|---|---|---|
| Slack | Slack Technologies (Salesforce) | Digest notifications a project chooses to deliver to its own Slack workspace: thread titles, comment excerpts, author names | United States |
Transfers
The service's primary data store is EU-resident: the Convex deployment behind every project runs in Convex's EU (Ireland) region, and product analytics go to PostHog's EU cloud — so feedback content, screenshots, account data and analytics events are stored in the European Union. A "US entity" note above means the provider is a US company operating that EU region — its own personnel access is governed by its data-processing terms.
Where a provider does process data outside the EEA — Sentry error reports, Resend invitation emails, Cloudflare's global edge, Google sign-in, Slack digests — transfers rely on the EU–US Data Privacy Framework (for certified providers) and/or Standard Contractual Clauses in that provider's data-processing terms, per section 4 of the DPA.
Changes to this list
New or replaced sub-processors are announced by updating this page
at least 14 days before they process customer data. This file lives
in the open-source repository at
legal/subprocessors.md —
its git history is the change log, and watching the repository is the
subscription mechanism. Objections: hello@pixelmatters.com (see DPA
§3 for the objection process).