Sub-processors
Last updated: May 7, 2026
OG Traffic uses the following sub-processors to provide the service. We list each vendor's purpose, where they process data, and the mechanism we rely on for any transfer of personal data outside the EEA. We notify customers via email of any material change to this list at least 30 days before the change takes effect, in line with GDPR Article 28(2).
| Vendor | Purpose | Region | Transfer mechanism | DPA |
|---|---|---|---|---|
| Hetzner Online GmbH | Application hosting (web + worker + Postgres) | Germany (EU) | EEA — no transfer | Link |
| Cloudflare, Inc. | CDN, DNS, R2 object storage, edge cache | Global (data hosted in EU R2 region) | EU SCCs + EU-US DPF | Link |
| Resend, Inc. | Transactional email (sign-in links, deletion confirmations) | United States | EU SCCs | Link |
| OpenRouter, Inc. | AI model API access (Anthropic Claude, OpenAI GPT, Google Gemini routing) | United States (routes to model provider region) | EU SCCs | Link |
| Sentry (Functional Software, Inc.) | Error monitoring + performance tracing | United States (EU region available) | EU SCCs + EU-US DPF | Link |
| Plausible Analytics | Cookie-less, privacy-respecting website analytics | Germany (EU) | EEA — no transfer | Link |
| DataForSEO | SERP / keyword / backlink data for SEO research | United States | EU SCCs | Link |
| Jina AI | URL fetch + reader for research phase (converts pages to markdown) | Germany (EU) | EEA — no transfer | Link |
| Tavily | Search API for grounded research | United States | EU SCCs | Link |
| Perplexity AI | Research summaries with citations | United States | EU SCCs | Link |
| Langfuse | LLM observability / cost tracking | Germany (EU) | EEA — no transfer | Link |
| Google LLC | OAuth sign-in (optional), Google Search Console / Analytics integrations | United States | EU SCCs + EU-US DPF | Link |
| Stripe, Inc. | Payment processing (only when subscriptions activate; not used in current closed beta) | United States | EU SCCs + EU-US DPF | Link |
Object to a sub-processor
Per GDPR Art. 28(2), if you object on reasonable grounds to a new sub-processor we add, you may terminate your subscription and receive a pro-rata refund of any pre-paid fees. Contact privacy@ogtraffic.com within 14 days of our notification email.
Audit + records of processing
We maintain a Records of Processing Activities (RoPA) per Art. 30 and will provide it to a customer Data Protection Officer or supervisory authority on reasonable written request.