Sub-processors
The companies we rely on to run QRSalt, what each one handles, and how data leaving Europe is protected.
Last updated 29 September 2026
Sub-processors
These process personal data on our behalf, including the data we process for business customers under our data processing agreement. Each is bound by a written contract with data protection terms that meet Article 28 of the GDPR.
| Provider | What for | Data involved | Where | Transfer basis |
|---|---|---|---|---|
| DigitalOcean, LLC | Hosting: the server that runs the service, its database, uploaded files (logos, pictures, PDFs) and the backups kept on the server. | Everything the service stores, including scan records and form responses held for customers. | United States (New York, NYC3) | Standard Contractual Clauses in DigitalOcean’s data processing agreement. |
| Cloudflare, Inc. | DNS, content delivery and caching, TLS, protection against attacks, the approximate location of each request, the Turnstile bot check, and access control for our staff in front of our admin area. | IP address and request details for every visit and scan through our domains, in transit; cached copies of public pictures; the identity of our own staff for admin access. | Global network; United States company | EU–US Data Privacy Framework, and Standard Contractual Clauses in Cloudflare’s data processing addendum. |
| Cloudflare, Inc. (R2 storage) | Off-site backups. Each backup is encrypted on our server before it is uploaded, with a key only we hold, so Cloudflare cannot read it. | Encrypted copies of the database and uploaded files. Kept up to 12 months. | Storage location chosen automatically by Cloudflare | EU–US Data Privacy Framework, and Standard Contractual Clauses in Cloudflare’s data processing addendum. |
| Resend (Plus Five Five, Inc.) | Sending account and service email (sign-in codes, receipts, invitations, notices) and emails about getting started. | Recipient email address, the content of the message and its delivery status. | United States | Standard Contractual Clauses in Resend’s data processing agreement. |
| Amazon Web Services, Inc. (Amazon SES), through Resend | Delivers the email that Resend sends for us. | Recipient email address and the content of the message. | United States | EU–US Data Privacy Framework, and Standard Contractual Clauses in the terms between Resend and Amazon. |
| Google LLC (Safe Browsing) | Checking the destinations of codes against lists of malware and phishing sites. | Destination URLs only. Not linked to any person by us. | United States | EU–US Data Privacy Framework. |
Independent recipients
These receive personal data from or about you, but decide themselves how to use it under their own privacy policies. They are not our sub-processors, and they never receive the scan records or form responses we hold for customers.
| Provider | What for | Data involved | Where | Transfer basis |
|---|---|---|---|---|
| Whop, Inc. | Checkout, payment and subscription management for paid plans. | Your name, email, billing details and payment method, collected by Whop on its own payment pages. | United States | Whop’s own terms and privacy policy. |
| Google LLC / Google Ireland Ltd (Google Ads, including the Data Manager API) | Measuring which ads lead to sign-ups and purchases, only as your cookie choice allows. Our server reports a purchase through the Data Manager API as a backup to the browser tag. | Ad click identifier, visit and conversion events (for a purchase, the amount paid and time), IP address and browser details from the tag, and, only with ad consent, a hashed (SHA-256) form of the buyer’s email. | United States and Ireland | EU–US Data Privacy Framework; Google’s advertising data protection terms. |
| Google LLC / Google Ireland Ltd (Google Analytics) | Measuring how the public pages are used, only as your cookie choice allows. Never in the signed-in dashboard or on pages reached by scanning a code. | Pages viewed, device and browser details, IP address (for approximate location), and sign-up and purchase events with the method, plan and amount. No name or email. | United States and Ireland | EU–US Data Privacy Framework; Google’s data protection terms for Analytics. |
| Google LLC (Sign in with Google) | Letting you sign in with a Google account, if you choose to. | Your name, email address and Google account identifier, sent to us by Google. | United States | EU–US Data Privacy Framework. |
Where your data is stored
We are a Norwegian company, but the service itself runs in the United States, on one DigitalOcean server in New York, with encrypted off-site backups in Cloudflare R2. That is a transfer out of the European Economic Area, and it is covered by the safeguards listed against each provider above. Scans through a customer's own domain reach our server directly rather than through Cloudflare.
Changes to this list
We update this page at least 30 days before a new sub-processor starts handling customer data, and change the date at the top. Business customers can object to a new sub-processor as the data processing agreement describes. To be told about changes by email, write to support@qrsalt.com with the subject "Sub-processor updates".