Sub-processors
Version v2 · Updated 4 July 2026
To provide the service to you, we share strictly necessary data with the following sub-processors, each under its own Data Processing Agreement (DPA). The marketing sub-processors (Meta, Google Ads, LinkedIn) are activated only if you have given consent for the Marketing category in the cookie banner or in the dashboard.
| Sub-processor | Role | Data | Jurisdiction | Lawful basis | DPA |
|---|---|---|---|---|---|
| Stripe | Payment processing, subscriptions, invoices | Email, name, IP, last 4 card digits, amount. The payment-session metadata also includes the marketing cookie identifiers (_fbp, _fbc, li_fat_id) for attributing the conversion to the source platform. | Ireland (EU) + USA | Contract | View |
| Google (Workspace) | Inboxes for customers' domains | Email content (controlled by the customer), metadata | Ireland (EU) | Contract | View |
| cyberFolks (formerly MXHost) | .ro domain registration | WHOIS data (company name, fiscal code, address) | Romania | Contract | View |
| Cloudflare | DNS, CDN, DDoS protection | DNS queries, IP, user agent (logged for 4h) | Ireland (EU) + USA | Legitimate interest | View |
| Postmark | Transactional email + notifications | Recipient email, email content | USA | Contract / legitimate interest | View |
| Sherweb | Google Workspace provisioning | Admin email, domain name | Canada | Contract | View |
| Railway | Application + database hosting | All data processed in the application | USA (EU region available) | Contract | View |
| Plausible Analytics | Cookieless traffic analytics | Pages visited, referrer, device, country — aggregated data, no identifiers | EU (Estonia / Germany) | Legitimate interest | View |
| PostHog | Product analytics | Product events, pages visited, device identifier; profile only for authenticated users | EU (Germany) — PostHog Inc. (USA) is the vendor | Consent (Analytics) | View |
| Sentry | Error and performance monitoring | Stack traces, IP, user agent, user identifier on errors; session replay with text masked | USA | Legitimate interest (operation and security) | View |
| Meta Platforms (WhatsApp Business Platform) | Routing the messages between a client company and its customers (the optional WhatsApp Business service) | Customer message content, phone numbers, WhatsApp Business Account (WABA) metadata. Enabled only for the companies that connect the WhatsApp Business service. | Ireland (EU) + USA | Contract (service delivery) | View |
| Meta Platforms (Facebook / Instagram) | Measuring conversions from Meta ads (browser Pixel + server-to-server Conversion API) | Cookie identifiers (_fbp, _fbc), fbclid, IP, user agent, pages visited, conversion events (registration, payment), value. Contact data (email, phone, first name, last name, city, country) hashed with SHA-256 — we never send plain-text contact data. | Ireland (EU) + USA | Consent | View |
| Google Ads | Measuring conversions from Google Ads (browser gtag.js + Enhanced Conversions API) | Cookie identifiers (_ga, _gid), gclid, IP, user agent, conversion events, value. Contact data (email, phone, first name, last name) hashed with SHA-256. | Ireland (EU) + USA | Consent | View |
| LinkedIn (Microsoft Ireland) | Measuring conversions from LinkedIn Ads (Insight Tag + Conversions API) | Cookie identifier li_fat_id, IP, user agent, conversion events. Contact data (email, first name, last name) hashed with SHA-256. | Ireland (EU) + USA | Consent | View |
We notify you by email at least 30 days before adding a new sub-processor. You can object at privacy@emailfirma.ro.