1. The list
We keep the number of providers deliberately small. These are all of them — there is no fourth party, no analytics vendor and no advertising network.
| Provider | What it does | What it can see | Where |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, edge compute, database (D1), object storage (R2), key-value store, queues | Everything the Service stores: account records, hashed keys, usage logs, credit ledger | Global edge network, including the United States |
| Paddle.com Market Ltd | Merchant of Record — payment processing, invoicing, sales tax and VAT | Name, email, billing address, payment method, transaction history | United Kingdom and European Union |
| Email delivery provider | Sending transactional email: receipts, low-balance warnings, renewal and account notices | Email address and message contents | Depends on provider; disclosed here once configured |
2. What none of them receive
The contents of your API requests and responses are not stored, so they are not passed to any subprocessor for storage. Your inputs are processed in memory to produce a result and then discarded.
We never receive your card details, so we cannot pass them anywhere. Card data goes directly from you to Paddle.
API keys exist in our database only as hashes. A subprocessor with database access still could not make calls as you.
3. Tools that call third parties on your instruction
Some tools fetch data from an external source to answer your query — a WHOIS registry, a certificate transparency log, an IP geolocation service. Those services receive the target you asked about (a domain, an IP address), not your identity or your account details.
They are not subprocessors of your personal data: they act on the lookup value you supplied. Each tool's upstream source is documented in the API catalogue, and every one of them is swappable through configuration if a provider becomes unsuitable.
4. Changes
We will update this page before a new subprocessor starts handling customer data. If you have a data processing agreement with us that requires advance notice, we will follow the notice period in that agreement.
To be told when this page changes, or to request a data processing agreement, email privacy@toolsxpo.com. How we handle your data overall is covered in the Privacy Policy.