Sub-processors
Effective date: August 10, 2026
Last updated: September 18, 2026
These are the third-party providers that process personal data on Markup's behalf, per section 3 of the Data Processing Agreement. The list is deliberately short, and the widget adds nothing to it on host pages, because it talks only to the Markup backend.
Infrastructure (always active)
| Sub-processor | Entity | What it processes | Location |
|---|---|---|---|
| Convex | Convex, Inc. | The database, backend functions and file storage behind every project, covering all service data, including feedback content and screenshots | European Union (Ireland; US entity) |
| Cloudflare | Cloudflare, Inc. | Hosting and delivery of the dashboard's static pages; request logs (IP addresses) in the ordinary course of serving them | Global edge (US entity) |
| Google Ireland Ltd. | Sign-in for dashboard accounts (OAuth). Receives the fact that you signed in; provides us your name, email and avatar | EU / United States |
Product operations (always active)
| Sub-processor | Entity | What it processes | Location |
|---|---|---|---|
| PostHog | PostHog, Inc. | Product analytics: dashboard events keyed to account id and email with URLs masked to route patterns; widget usage counts keyed to projects with no person-level data. Also error diagnostics: error message, stack trace, page URL and browser user agent, plus the account id and email already sent for dashboard analytics; widget end users are not identified | European Union (EU cloud) |
| Resend | Resend, Inc. | Invitation emails: the invited address, the inviter's name and reply-to address, and the workspace and project names that appear in the message | United States |
Configured per project (active only if you enable it)
| Sub-processor | Entity | What it processes | Location |
|---|---|---|---|
| Slack | Slack Technologies (Salesforce) | Digest notifications a project chooses to deliver to its own Slack workspace: thread titles, comment excerpts, author names | United States |
Comment classification (off by default)
These process comment content only while the comment classifier is switched on for a deployment, and are listed here ahead of that, per the 14-day notice below.
| Sub-processor | Entity | What it processes | Location |
|---|---|---|---|
| Vercel | Vercel, Inc. | Routes each new comment to the classification model through the AI Gateway: the comment text, the project's comment-access mode, whether the author is a project member, and the page path — no identity | United States |
| TypeSafe AI | TypeSafe AI, Inc. | Classifies that same content, returning a label and two probabilities. It is a decision model: it returns no generated text and the request carries no account or person identifier | United States |
Every one of these calls is made under zero data retention, so the content is not retained by either provider. Author name, email, commenter id, user id, mention ids, the full page URL and screenshots are never sent.
Transfers
The service's primary data store is EU-resident: the Convex deployment behind every project runs in Convex's EU (Ireland) region, and product analytics go to PostHog's EU cloud, so feedback content, screenshots, account data and analytics events are stored in the European Union. A "US entity" note above means the provider is a US company operating that EU region, and its own personnel access is governed by its data-processing terms.
Where a provider does process data outside the EEA, as with Resend invitation emails, Cloudflare's global edge, Google sign-in, Slack digests and comment classification, transfers rely on the EU-US Data Privacy Framework (for certified providers) and/or Standard Contractual Clauses in that provider's data-processing terms, per section 4 of the DPA.
Changes to this list
New or replaced sub-processors are announced by updating this page
at least 14 days before they process customer data. This file lives
in the open-source repository at
legal/subprocessors.md, whose
git history is the change log, and watching the repository is the
subscription mechanism. Objections: hello@pixelmatters.com (see DPA
§3 for the objection process).