Subprocessors
Current subprocessors
| Subprocessor | Function | What is shared | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, storage (databases, key-value, object storage), server-side analytics, bot challenge. All Dark Orb data sits on Cloudflare infrastructure. | All service data, including account data, composed sites, and visitor form submissions | Global edge |
| Anthropic, PBC | AI composition, image-suitability screening, alt-text generation, logo analysis, answering the questions you ask about your customers | Your intent text and the content to be composed; image descriptions; a logo you upload for logo composition; when you ask a question about your customers or for a thread summary, the relevant enquiry text | US / EU |
| OpenAI, L.L.C. | AI image generation; backup AI composition if Anthropic is unavailable | Image-generation prompts derived from your composed content; in a failover, the same content Anthropic would receive, including relevant enquiry text when you ask a question about your customers or for a thread summary | US |
| Cloudflare Workers AI | Backup AI image generation if OpenAI is unavailable | Image-generation prompts derived from your composed content | Cloudflare network |
| Resend (Plus Five Five, Inc.) | Sending passwordless magic-link sign-in emails; delivering new-submission notifications for the forms on the sites you build; sending booking and newsletter confirmations to visitors; delivering the replies you send to your customers | Recipient email address and the sign-in link; for form notifications sent to you as the site owner, the visitor's submission content (name, email, message, and any custom fields); for booking and newsletter confirmations, the visitor's email address, name and appointment time; and, for replies you send, the customer's email address and your message | US |
| Brevo (Sendinblue SAS) | Backup email delivery: sends the same emails as Resend when Resend cannot | The same data as the Resend row, for any email Brevo sends in its place | EU (France) |
| Pexels | Stock-image search | Search phrase only | US |
| Openverse (WordPress.org) | Stock-image search across openly licensed images | Search phrase only | US |
| Google Public DNS and Cloudflare DNS | Checking the domain records of a custom domain you connect | The domain name you ask us to check | Global |
Visitor data (form submissions, bookings and newsletter subscribers), which we process as your processor under the Data Processing Agreement, is stored on Cloudflare. Form submissions are emailed to you, the site owner, through Resend (or Brevo, our backup email provider, when Resend cannot send) so you are notified of new submissions, and booking and newsletter confirmations are emailed to the visitor the same way. When you reply to a customer from your portal, your reply is delivered to them through Resend. When you ask a question about your customers, or for a summary of a thread, and answering needs interpretation, the relevant enquiry text is sent to Anthropic, or to OpenAI as a backup if Anthropic is unavailable. This happens only when you ask, never automatically. Where a row says backup, that provider only sees data if the main one fails. We do not send visitor data to Cloudflare Workers AI, Pexels, Openverse, or any other subprocessor, and we do not use it for our own purposes.
Planned subprocessors (not yet in use)
These providers are integrated in the codebase but are not yet processing live personal data. They will move into the table above when they go live, with notice.
| Subprocessor | Function | When | Location |
|---|---|---|---|
| Stripe, Inc. | Subscription billing and payment processing | When paid plans launch | US / EU |
| Sentry (Functional Software, Inc.) | Error monitoring, minimised of personal data | When enabled | EU / US |
International transfers
Some subprocessors are based outside the UK. Where personal data is transferred internationally, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Transfers to providers based in the EU, such as Brevo, rely on the UK's adequacy regulations for the EEA. The specific mechanism cited per subprocessor is being confirmed with our solicitor and does not change the safeguards you are entitled to.
Staying informed of changes
This is the current set of subprocessors. We will give reasonable notice before adding a new subprocessor that handles personal data, by updating this page and its version. If you want to be told of changes, email hello@darkorb.ai asking to be added to subprocessor-change notifications, and we will let you know before a change takes effect. If you are a controller using Dark Orb as your processor and you reasonably object to a new subprocessor on data-protection grounds, clause 5 of the Data Processing Agreement sets out what happens.
← Back