Subprocessors
What this list is. Subprocessors are third-party companies we use to deliver parts of VerifyEat. Under GDPR Art. 28(2), customers have the right to know who they are. This page is updated whenever we add, remove, or replace one. Material changes are also announced 30 days in advance via email to active subscribers.
Active subprocessors
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Cloudflare, Inc. | Static hosting (Cloudflare Pages), CDN, DNS, DDoS protection for verifyeat.com | IP address, user agent, request metadata, security cookie (__cf_bm) |
Global edge network, USA-headquartered |
| Anthropic, PBC | AI translations of menu text, only when triggered by the customer using their own API key | Product names, descriptions, ingredient lists submitted for translation | USA |
| rsms.me (Rasmus Andersson) | Inter font CSS used by the marketing site | IP address, user agent (no cookies observed) | Sweden / global CDN |
| Apple Inc. | Code signing & notarisation of the macOS app, App Store distribution if applicable | Build metadata, Apple Developer ID | USA / Ireland |
Platform providers
These providers support distribution, billing, or platform services. They may act as independent controllers under their own terms rather than as VerifyEat subprocessors.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Apple Inc. / Apple Distribution International | Mac App Store distribution, subscription billing, purchase validation, refunds | Apple ID and billing data handled by Apple; local entitlement state handled by the app | Global |
| Postmark / Resend (planned, TBD) | Transactional email (receipts, password reset, security notices) | Email address, message content | USA / EU |
Things we deliberately do not use
For transparency, here is what we have intentionally not integrated, and why:
- Google Analytics, Mixpanel, Amplitude, etc. — no behavioural analytics on the marketing site.
- Meta Pixel, Google Ads, LinkedIn Insight, etc. — no advertising trackers.
- Intercom / Drift / chat widgets — no third-party chat or session-replay tools.
- Hotjar, FullStory, Clarity, etc. — no session recording.
- Sentry, Datadog RUM, etc. on the website — the static site is too simple to need them.
Notification of changes
When we add or replace a subprocessor that handles personal data of customers, we will:
- Update this page with the change date.
- Email active paying subscribers at least 30 days before the change takes effect.
- Where the change is material, give customers the opportunity to terminate their subscription with a pro-rata refund of any prepaid period.
Contact
Questions about a subprocessor or data flow? hello@verifyeat.com.