This list satisfies the GDPR Art.28 subprocessor-transparency requirement; it is updated as integrations change, and updates are not notified to each person individually.
Language and precedence: the Chinese text of this list is the master. This English version is a faithful translation provided for convenience and for payment-provider (MoR) onboarding. In the event of any conflict or ambiguity, the Chinese version governs.
| Subprocessor | Purpose | Data categories | Location / network |
|---|---|---|---|
| Cloudflare | Cloud infrastructure: Workers (compute), D1 (database), R2 (storage), Queues (asynchronous tasks) | All service operating data, query content, observation records | Global edge network |
| DataForSEO | Upstream data vendor: SERP / SEO / AI-overview data | Your queries (domains / keywords / questions) are forwarded in order to fetch data | Third party |
| MoR payment processor (effective on integration) | Payment and refund processing (Creem / Waffo Pancake to be decided) | Payment identifier (we never handle full card numbers) | Third party |
| Email / support tooling (to be decided) | Customer support and notifications | Email address, ticket content | Third party |
Disclosure points
- Your query content (domains / keywords / questions) is forwarded to upstream vendors such as DataForSEO — a necessary part of how the service operates (Privacy §3).
- Source IP addresses are not written to any data store (used only as a salted hash for rate limiting) and are not linked to your account (data-authorization-terms §3 / §4).
- The attribution obligation of upstream data vendors flows down into ToS §5; the per-vendor terms-consistency matrix is in
docs/data-authorization-terms.md§5.