Sub-processors
1. Overview
EmailProbe engages a small number of trusted third-party vendors ("sub-processors") to help deliver the email validation API and the surrounding service. Under the General Data Protection Regulation (GDPR) Article 28(2) and similar transparency requirements, we publish the current list of sub-processors here so customers can review and audit them.
Every sub-processor listed below is bound by a contract that requires them to (a) process customer data only on documented instructions, (b) maintain appropriate security measures, and (c) assist EmailProbe in fulfilling data subject rights.
2. Current Sub-processors
| Vendor | Purpose | Data Processed | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, edge compute, DNS, CDN, D1 database, KV cache, Workers, Durable Objects, Queues | All API request data, customer account data, hashed credentials, and operational metadata | Global edge (300+ data centers) |
| Microsoft Corporation (Clarity) | Marketing website analytics (heatmaps, session recordings, click data) | Page-view events, click events, mouse movement, device/browser metadata. Loaded only on emailprobe.dev marketing pages; not loaded in the authenticated app. | USA, EU regions |
| Sendinblue SAS (Brevo) | Transactional email delivery (account verification, password resets, billing notifications, security alerts) | Recipient email address, email content (templated transactional messages) | France (EU) |
| Dodo Payments | Payment processing (when paid plans are active) | Customer name, billing email, plan ID, payment amount. We do not receive or store card numbers. | USA, EU regions |
3. Vendor Details
Cloudflare
Cloudflare is the primary infrastructure provider for EmailProbe. The entire application runs on Cloudflare Workers; persistent data is stored in Cloudflare D1 (managed SQLite) and Cloudflare KV; rate limiting uses Cloudflare Durable Objects; background jobs run on Cloudflare Queues and Cron Triggers. Static pages are hosted on Cloudflare Pages.
Data shared: all API request data (after we apply SHA-256 hashing to submitted email addresses), customer account records, hashed API keys, configuration, and logs.
Cloudflare is GDPR-compliant and offers an EU-restricted processing mode. Reference: Cloudflare Privacy Policy and Cloudflare Customer DPA.
Microsoft Clarity
Microsoft Clarity is used only on the public marketing website (emailprobe.dev) to understand visitor behaviour and improve usability. It is not loaded on the authenticated application (app.emailprobe.dev) or on any page where signed-in users interact with their account data.
Data shared: anonymised behavioural data (clicks, scrolls, mouse movement), device and browser metadata, country derived from IP. Clarity automatically masks form fields and password inputs.
Reference: Microsoft Privacy Statement and Clarity FAQ.
Brevo (Sendinblue SAS)
Brevo delivers transactional emails on our behalf -- account verification messages, password resets, billing notifications, and security alerts. Marketing emails are not sent through this pipeline.
Data shared: recipient email address and the contents of the transactional message we are sending. Brevo does not use these addresses for its own marketing.
Reference: Brevo Privacy Policy.
Dodo Payments
Dodo Payments is our payment processor for paid plans. When you upgrade to a paid plan, Dodo handles the card transaction, recurring billing, and invoice generation.
Data shared: customer billing email, plan identifier, and the payment amount. Card numbers, CVVs, and bank credentials are entered directly into Dodo's secure form -- they never reach EmailProbe's servers.
Reference: Dodo Payments Privacy Policy.
4. Changes to This List
We will update this page whenever we add, replace, or remove a sub-processor. For customers on annual or enterprise plans, we provide advance notice via email at least 14 days before a new sub-processor begins processing customer data, giving you the opportunity to object.
If you would like to subscribe to sub-processor change notifications regardless of plan, contact support@emailprobe.dev with the subject "Sub-processor notifications" and we will add you to the list.
5. Related Documents
- Privacy Policy -- what data we collect and how we use it
- Terms of Service -- the agreement governing your use of the service
- Data Processing Agreement (DPA) -- governs our processing of personal data on your behalf. Self-serve acceptance; counter-signed copy available on request.
6. Contact
Questions about our sub-processors, our DPA, or our data-handling practices in general: