Subprocessors

01Introduction

1.1.This page forms part of our Privacy Notice. It lists the third parties ("subprocessors") that process personal data on behalf of Duckurity in connection with duckurity.com and the Duckurity Academy.

1.2.Each subprocessor processes personal data under a written contract, only on our instructions and only to the extent required for the function described below. We add a subprocessor to this list before it begins processing personal data. To be notified of changes, please contact privacy@duckurity.com.

02Current Subprocessors

• Subprocessor

  Vercel Inc.

  Function

  Application hosting

  Personal data processed

  Request data, IP addresses and the approximate location derived from them, application logs, profile preview images

  Location

  Frankfurt, Germany, with a global delivery network (company based in the United States)

  Status

  Active

• Subprocessor

  Supabase Inc.

  Function

  Database hosting

  Personal data processed

  Account data, and keyed hashes for rate limiting when Upstash is unavailable

  Location

  Frankfurt, Germany (company based in the United States)

  Status

  Active

• Subprocessor

  Upstash Inc.

  Function

  Rate limiting

  Personal data processed

  Keyed hashes of email addresses, IP addresses and Account identifiers only

  Location

  Frankfurt, Germany (company based in the United States)

  Status

  Active

• Subprocessor

  Cloudflare Inc.

  Function

  Hosting of duckurity.com, DNS, and bot protection on sign-in

  Personal data processed

  IP addresses, request headers, browser signals

  Location

  Global network (company based in the United States)

  Status

  Active

• Subprocessor

  Resend Inc.

  Function

  Email delivery

  Personal data processed

  Email addresses, email content

  Location

  Ireland (company based in the United States)

  Status

  Active

• Subprocessor

  Hetzner Online GmbH

  Function

  Lab infrastructure

  Personal data processed

  Session data and network activity within Labs

  Location

  Germany

  Status

  Planned

• Subprocessor

  Geidea

  Function

  Payment processing and card tokenization for payments in Egypt

  Personal data processed

  Card details (entered on Geidea's payment page), transaction data, billing details

  Location

  Egypt

  Status

  Planned

• Subprocessor

  Polar Software, Inc.

  Function

  Merchant of record for payments from outside Egypt

  Personal data processed

  Card details (entered on Polar's payment page), transaction data, billing address, tax information

  Location

  United States

  Status

  Planned

• Subprocessor

  Inngest Inc.

  Function

  Scheduled background processing

  Personal data processed

  Account identifiers only

  Location

  United States

  Status

  Planned

• Subprocessor

  PostHog Inc.

  Function

  Product analytics and error logging

  Personal data processed

  Identifiers, usage events, error data

  Location

  Frankfurt, Germany (company based in the United States)

  Status

  Planned

• Subprocessor

  Anthropic PBC

  Function

  AI model provider for Nester

  Personal data processed

  Questions submitted to Nester and Session context

  Location

  United States

  Status

  Planned

• Subprocessor

  OpenAI

  Function

  AI model provider for Nester

  Personal data processed

  Questions submitted to Nester and Session context

  Location

  United States

  Status

  Planned

• Subprocessor

  OpenRouter, Inc.

  Function

  Routing of Nester requests to AI model providers

  Personal data processed

  Questions submitted to Nester and Session context

  Location

  United States

  Status

  Planned

Model providers reached through OpenRouter: OpenRouter is configured to route Nester requests only to model providers located in the United States.

03Third-Party Sign-In

If you link your GitHub account to your Account and sign in with it, GitHub processes your sign-in in accordance with its own privacy policy.

04International Transfers

4.1.Where a subprocessor based in the United States has access to personal data from the European Union, we rely on the EU-U.S. Data Privacy Framework for certified subprocessors and on the European Commission's Standard Contractual Clauses for all others.

4.2.Personal data collected in Egypt is transferred to Germany, Ireland and the United States and, for traffic to duckurity.com, processed on Cloudflare's global network. We have applied to Egypt's Personal Data Protection Center for a cross-border transfer licence covering these transfers.

05Change Log