invisit uses the service providers below to run the Service. Those marked Customer Data may process personal data that invisit processes for its customers under the DPA. The rest only process data invisit controls itself, as described in the Privacy Policy.
| Provider | What it does for invisit | Data | Location of processing | Customer Data |
|---|---|---|---|---|
| Hetzner Online GmbH | Hosts the servers and databases that run the whole Service | All Service data, including analytics, links, accounts and logs | Falkenstein, Germany (EU) | Yes |
| Cloudflare, Inc. | DNS, CDN and proxy for invisit.dev and invisit.cc; TLS and routing for custom link domains | Request data in transit: IP address, user agent, URL, headers | Global network; company in the US | Yes |
| Cloudflare, Inc. (R2) | Stores preview images for short links and the profile pictures people upload | Link preview images, profile pictures and their URLs | Western Europe (EU) | Yes |
| Cloudflare, Inc. (R2) | Holds a site’s raw-data export for 24 hours so it can be downloaded, then deletes it | The site’s raw events and funnel definitions | Western Europe (EU) | Yes |
| Cloudflare, Inc. (R2) | Stores encrypted backups of the Service’s databases | All Service data, encrypted before upload | Eastern Europe (EU) | Yes |
| Cloudflare, Inc. (Email) | Sends account and notification email | Recipient email address, message content | Global network; company in the US | No |
| Cloudflare, Inc. (Turnstile) | Bot protection on sign-up | Browser and device signals of the person signing up | Global network; company in the US | No |
| Polar Software Inc. | Merchant of record: checkout, payments, tax, invoices and the customer portal | Name, email, billing address, payment details, purchase history | US | No |
| Google LLC | “Sign in with Google”, only when a user chooses it | Google account id, name, email, profile picture | US | No |
| GitHub, Inc. | “Sign in with GitHub”, only when a user chooses it | GitHub account id, name, verified primary email, profile picture | US | No |
Not subprocessors
Some integrations are chosen and configured by the customer, and invisit connects to them on the customer’s instructions: payment providers connected for revenue analytics (Stripe, Paddle, Lemon Squeezy, Polar, Creem, Dodo Payments) and alert destinations (Slack, Discord, webhooks). They act for the customer, under the customer’s own agreements with them.
invisit resolves visitor locations with a geolocation database (DB-IP) that runs on its own servers. No visitor data is sent to the database’s publisher.
Changes
We give at least 30 days’ notice before a new subprocessor starts processing Customer Data. To get
notices, email privacy@invisit.dev with the subject “Subprocessor updates”, or watch this page.
Customers can object as set out in section 7 of the DPA.