Subprocessors
Version 2026-10-13. The companies that process personal data on Waffle Corp.'s behalf, what each does, where, and the safeguard for data of people in the EEA, the UK and Switzerland. Part of the Privacy Policy (section 15). We update this page before a new provider receives any personal data; the date at the top changes, and earlier versions are available on request.
| Provider | Legal entity | What it does for Waffle | Personal data it sees | Location | Transfer safeguard (EEA/UK/CH) |
|---|---|---|---|---|---|
| Supabase | Supabase, Inc. (United States) | Database and sign-in (authentication) for accounts, Personal Sync and shared folders | Email address, account number, sign-in sessions (time, browser description, IP address), the unencrypted Sync and sharing facts listed in the Privacy Policy, and the encrypted records | United States (AWS, N. Virginia) | Standard Contractual Clauses, through Supabase's data processing addendum (being signed) |
| Cloudflare | Cloudflare, Inc. (United States) | Storage of encrypted file bytes (R2); hosting of the waffle.page website | Encrypted file bytes and sizes; IP address and time of each request | United States (R2 US jurisdiction) | EU-U.S. Data Privacy Framework (UK and Swiss extensions), with Standard Contractual Clauses as fallback |
| GitHub | GitHub, Inc. (Microsoft) (United States) | Serving the app at app.waffle.page (GitHub Pages); holding our nightly database backup | IP address when loading the app; the encrypted backup (account email addresses inside it) | United States | EU-U.S. Data Privacy Framework (UK and Swiss extensions), with Standard Contractual Clauses as fallback |
| Backblaze | Backblaze, Inc. (United States) | Second copy of encrypted file bytes (up to 33 days); the record that stops a restored backup from bringing a deleted account back (up to 47 days) | Encrypted file bytes and sizes; a one-way fingerprint of a deleted account's sign-in identifier and the day | United States (US East) | EU-U.S. Data Privacy Framework (UK and Swiss extensions) |
| Postmark | ActiveCampaign, LLC (United States) | Sending Waffle's email: sign-in links, deletion emails, plan notices | Email address, the emails sent (kept 45 days) | United States | EU-U.S. Data Privacy Framework (UK and Swiss extensions) |
| Stripe | Stripe, Inc. and its acquiring affiliates (United States; Stripe Technology Europe, Ltd. for European payments) | Merchant of record and payment processing for purchases on the web and from the Mac app (Managed Payments, "Sold through Link"); receipts; customer portal | Email address, plan, price, payment method, billing country/address, IP address and device details on its pages; Waffle's account number as a reference | United States and Ireland | Stripe is an independent controller for payment processing; EU-U.S. Data Privacy Framework and Standard Contractual Clauses under Stripe's own terms |
| Apple | Apple Inc. / Apple Distribution International Ltd. | In-app purchases in the iPhone and iPad app | A random token linking the purchase to the Waffle account; what Apple collects under its own policy | United States and Ireland | Independent controller; Apple's own safeguards |
| Google LLC / Google Ireland Ltd. | In-app purchases in the Android app | A random token linking the purchase to the Waffle account; what Google collects under its own policy | United States and Ireland | Independent controller; Google's own safeguards |
Contacted but not processors. Hugging Face (public AI model files) and OpenFreeMap (map tiles) receive only your IP address and the time of the request, as any website would, and receive nothing else from Waffle. An AI provider you use with your own key receives what you select, directly from your device, under your own agreement with it — Waffle is not party to it.
Not running yet. Backblaze receives nothing until the second copy of stored files is switched on; Stripe, Apple and Google receive nothing until paid plans are on sale. The Privacy Policy's section "Not running yet" is kept current with this page.
Questions: contact@waffle.page.