This page lists the third parties that process customer data on behalf of SpaceSite (sub-processors under Article 28(2) GDPR). It is referenced by the Data Processing Agreement and the Privacy Policy.
1. How we notify changes
We update this page and the "Last updated" date at least 30 days before a new or replaced sub-processor starts processing customer data.
Customers may object in writing to info@spacesite.dev within those 30 days, as described in section 6 of the DPA.
Customers who want an email notice of changes can ask for it at info@spacesite.dev. [OPEN: notification channel]
Last updated: 2026-10-01.
2. Current sub-processors
Name
Service and purpose
Location
Data processed
Transfer basis
Vendor DPA
Added
Cloudflare, Inc.
Workers (API and site delivery), D1 (metadata, sync state, aggregated counters), R2 (site content and attachments), Cache, Cloudflare for SaaS (custom hostnames, TLS), Web Analytics on spacesite.dev (cookieless)
San Francisco, USA. R2 with EU jurisdiction; D1 with EU location hint; Workers on the global network
Published content, page metadata, cloudId, space key, visitor technical data, logs (7 days)
Cloudflare Customer DPA incorporating EU SCCs (2021/914) and UK addendum; EU storage settings
Transactional email (export links, service notices)
USA; sending region us-east-1 (verified 2026-09-29)
Recipient email address, email content
Resend DPA incorporating EU SCCs (2021/914)
https://resend.com/legal/dpa (checked 2026-10-01)
2026-10-01
3. Conditional sub-processor
Active only if SpaceSite sells a plan or a one-time export outside the Atlassian Marketplace. Not active at the date of this draft.
Name
Service and purpose
Location
Data processed
Role and transfer basis
Vendor terms
Status
Polar Software Inc.
Merchant of record: checkout, invoicing, taxes, refunds, licence keys for purchases outside the Marketplace
USA
Purchaser name, email, billing address, payment status, order ID. No card data reaches SpaceSite
Polar is the seller of record and an independent controller for payment data. Any processing on our behalf (for example licence status) is covered by Polar's terms; DPA link to be obtained
https://polar.sh/legal/privacy (checked 2026-10-01; a dedicated DPA page was not found)
Conditional, not active
4. Parties that are not our sub-processors
Party
Why it is listed
Relationship
Atlassian Pty Ltd / Atlassian US, Inc.
The app runs on the Forge platform. App settings (cloudId, space key, admin accountId) are stored in Forge hosted storage inside the customer's tenant
Atlassian is the customer's own processor under the customer's Atlassian agreement. Atlassian handles Marketplace billing as the seller. The app stores no Atlassian tokens outside Atlassian. Atlassian DPA: https://www.atlassian.com/legal/data-processing-addendum
The customer's DNS provider or registrar
The customer creates a CNAME to connect a custom domain
Chosen and contracted by the customer
5. Change log
Date
Change
2026-10-01
First draft: Cloudflare and Resend listed; Polar listed as conditional
6. Open points for the owner
Confirm whether Polar will be activated after the 06/10/2026 gate. If not, delete section 3. If yes, request Polar's DPA or data processing terms and add the link.
Confirm on the production Cloudflare account that the R2 bucket uses the EU jurisdiction and the D1 database uses the EU location hint, and record the date.
Decide how customers subscribe to sub-processor change notices (email list, RSS, or page only).
Verify the exact legal entities and addresses for Cloudflare, Resend and Polar from their DPAs and add them to the table.
Decide whether Cloudflare Web Analytics on spacesite.dev needs to appear here (no personal data is processed) or only in the Privacy Policy.
Check whether Cloudflare and Resend hold an EU-US Data Privacy Framework certification and, if so, add it as an additional transfer basis.