Platform policies
Subprocessors
Last updated · October 24, 2026
These are the providers that process personal data for UpgradIQ, Inc. when you use Surfil. They are the subprocessors referred to in our Data Processing Addendum and Privacy policy. Each is bound by a written agreement with data protection terms that are no less protective than ours.
| Name | Purpose | Location | When used |
|---|---|---|---|
| Cloudflare | Website and app hosting, file storage, scheduled jobs, Pixel collection and raw events (7 days), DNS and abuse protection | Global network, files preferably in Eastern Europe | Always |
| Supabase | Database and sign in | EU (Frankfurt) | Always |
| Stripe | Payments and billing | United States | When you pay |
| Amazon SES | Email delivery | United States | Always |
| Sentry | Error monitoring | United States | Always |
| Mixpanel | Product analytics | United States | When you use the site |
| Upstash | Rate limiting | Global network | Always |
| PostHog | Product events, recorded on our servers | United States | When you use the product |
| Search Console, Analytics | United States, global | If you connect it | |
| AI text service | Internal drafting, contact details removed | United States | Internal only |
Notes
- Card numbers are handled by Stripe only; we never receive them.
- Google is a subprocessor only for members who connect Search Console or Analytics, and only for read-only data.
- The AI text service is used for internal drafting only. It never receives a member’s name, email address or account data.
- Mixpanel receives page views and key actions tied to a random identifier (your account id once you sign in), never a name or email address, and does not run when your browser sends Do Not Track or Global Privacy Control.
- Surfil Pixel raw events are held on Cloudflare for at most 7 days; daily totals are stored in our database at Supabase.
Changes
When we add or replace a subprocessor that handles customer data, we update this page before the change takes effect. To be told by email, write to hello@surfil.com and ask to be on the list. You may object to a new subprocessor on reasonable data protection grounds, following the process set out in the Data Processing Addendum.