1. The list
We keep the number of providers deliberately small. These are all of them — there is no other party, no analytics vendor and no advertising network.
| Provider | What it does | What it can see | Where |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, edge compute, database (D1), object storage (R2), key-value store, queues | Everything the Service stores: account records, API keys, usage logs, credit ledger | Global edge network, including the United States |
| Cloudflare, Inc. — Workers AI | Running AI models for the AI tools (summarisation, image OCR, embeddings) | The text or image you submit to an AI tool, and the model's response. Not stored by us. | Cloudflare's global network, including the United States |
| Paddle.com Market Ltd | Merchant of Record — payment processing, invoicing, sales tax and VAT | Name, email, billing address, payment method, transaction history | United Kingdom and European Union |
| Email delivery provider | Sending transactional email: receipts, low-balance warnings, renewal and account notices | Email address and message contents | Depends on provider; disclosed here once configured |
2. AI tools are the exception, and only AI tools
The contents of your requests and responses are not stored by us — inputs are processed in memory to produce a result and then discarded. For almost every tool that is the end of it, because the work happens in your own browser and nothing reaches us at all.
AI tools work differently, and it matters. When you use AI Text Summarizer, AI Image OCR or AI Text Embeddings, what you submit is sent to Cloudflare Workers AI to be processed by a model, together with the model's response. We do not store either. We record only how many tokens were used, which model ran, and what the call cost — never the content itself.
We use model providers on terms that do not permit training on this traffic. Treat that as a contractual position rather than something we can enforce technically from our side: if content must not leave your own systems, do not put it into an AI tool. Every tool page states which kind it is.
We never receive your card details, so we cannot pass them anywhere. Card data goes directly from you to Paddle.
3. Tools that call third parties on your instruction
Some tools fetch data from an external source to answer your query — a WHOIS registry, a certificate transparency log, an IP geolocation service. Those services receive the target you asked about (a domain, an IP address), not your identity or your account details.
They are not subprocessors of your personal data: they act on the lookup value you supplied. Each tool's upstream source is documented in the API catalogue, and every one of them is swappable through configuration if a provider becomes unsuitable.
4. Changes
We will update this page before a new subprocessor starts handling customer data. If you have a data processing agreement with us that requires advance notice, we will follow the notice period in that agreement.
To be told when this page changes, or to request a data processing agreement, email privacy@toolsxpo.com. How we handle your data overall is covered in the Privacy Policy.