Subprocessors
Last updated
Summary
- These companies run parts of QRdx for us and may handle personal data while doing it: hosting, the database, email, billing, AI, file storage, spam checks, analytics and the feedback widget.
- PostHog and Featurebase only receive data from visitors who allow them in Cookie settings.
- Services you connect yourself, such as Dub or Google Drive, are not on this list: data reaches them only because you asked for it.
- We update this page before a new subprocessor starts handling personal data.
Last updated: 1 November 2026
Current subprocessors
| Service | What it does for QRdx | Personal data it handles | Location | Policy |
|---|---|---|---|---|
| Vercel | Hosting, edge network and server functions. Looks up the country and city of each request from its IP address, and registers custom domains and their TLS certificates. | Everything that passes through the Service, including IP addresses of requests | United States, with a global edge network | DPA |
| Neon | PostgreSQL database | Account data, Customer Content and End User data (scans, page events, form responses) | United States | DPA |
| Upstash | Rate limiting | IP addresses and account IDs inside short-lived counters that expire within 2 days | [[UPSTASH REGION]] | Privacy policy |
| Polar | Merchant of record: checkout, subscriptions, invoices and sales tax. Card payments go through Stripe. | Name, email address, billing address, payment details, tax ID, subscription history | United States | Privacy policy |
| Resend | Sending transactional email | Recipient addresses and email content: invitations, form response notifications (which include answers), alerts and digests | United States | DPA |
| Google (Gemini API) | AI themes and prompt enhancement | Prompts, the conversation so far and attached images | Global, wherever Google has facilities | Gemini API terms |
| Google (Web Risk) | Checking links against Google's lists of malware and phishing sites | Destination URLs of dynamic codes and links checked with the scan checker | Global | Google Cloud DPA |
| fal.ai | AI QR art and image upscaling, when AI art is turned on | The code's content, prompts, reference images and generated images | United States | Privacy policy |
| Cloudflare (R2) | Storage for files you upload, when file storage is turned on | Uploaded files and anything they contain | [[R2 BUCKET LOCATION]] | DPA |
| Cloudflare (Turnstile) | Telling people from bots on the abuse report form and on hosted-page forms | IP address and browser signals | Global | Turnstile privacy |
| PostHog | Product analytics on qrdx.dev, only with consent | Pages viewed, clicks and features used; email address and name when signed in | United States | DPA |
| Featurebase | Feedback and support widget on qrdx.dev, only with consent | What you type into the widget, browser details | European Union | Privacy policy |
How we protect transfers out of the EEA, the UK and Switzerland is described in the Privacy Policy.
Services that aren't subprocessors
Data reaches these services only because you, or the owner of a code or page, chose to use them. Their own terms and privacy policies apply.
- Sign-in providers: Google and GitHub, when you sign in with them.
- Integrations you connect: Dub, Google Drive and, as they become available, Bitly, Rebrandly, Short.io, Dropbox, OneDrive, Box, Notion, Stripe, Cal.com, Calendly, Shopify, Google Sheets, Slack, HubSpot, Mailchimp, Spotify and YouTube. See the integrations directory.
- Destinations you set up for notifications: your own webhooks and Slack or Discord channels.
- On hosted pages: maps and videos the owner embeds (Google Maps, YouTube, Vimeo, Loom) and tracking pixels the owner adds (Google Analytics, Google Tag Manager, Meta, TikTok, LinkedIn).
Changes to this list
When we add or replace a subprocessor, we update this page at least [[NOTICE PERIOD]] days before it starts handling personal data, except when we have to act sooner to keep the Service running or secure. Customers covered by the Data Processing Addendum can object to a change by emailing support@qrdx.dev during that period.
Related pages: Privacy Policy, Cookie Policy, Data Processing Addendum.
Changes: 1 November 2026. Rebuilt as a table from the services QRdx actually uses. Added Resend, Google Gemini, Google Web Risk, fal.ai, Cloudflare R2 and Turnstile, and Featurebase. Removed Anthropic (not used), Better Auth (a library that runs inside QRdx) and GitHub (a sign-in provider, now listed above). Corrected Polar's location.