Subprocessors
These providers support SiteAirbag. Only the services actually enabled for an environment receive relevant data.
Effective date: 18 oct 2026Cloudflare
Purpose: application hosting, content delivery, scheduled operations, network security, sampled operational logs/traces and Cloudflare Web Analytics, a cookieless aggregate count of page loads and web performance that does not depend on the optional analytics choice. Data: network and request metadata, minimized application/runtime traffic and operational telemetry. The exact contracting entity, processing locations, retention and transfer terms depend on the production account and are being verified.
Supabase
Purpose: managed PostgreSQL database, authentication, storage and edge functions. Data: account identifiers, workspace configuration, minimized runtime records and rescue requests. The production project is hosted in Central EU (Frankfurt). The account's contractual safeguards and any required transfer mechanism remain subject to the applicable provider terms.
Paddle
Purpose: merchant of record, checkout, tax, invoicing, subscription management and payment support. Data: purchaser identity, billing, subscription and transaction data. Paddle acts independently for much of its payment processing; SiteAirbag receives customer, transaction and entitlement identifiers rather than full card details.
Resend
Purpose: transactional and operational email delivery. Data: recipient email address and minimized message content. Scan reports you request by email are sent through Resend. Rescue notifications contain the request reference and contact details but not arbitrary structured rescue payload.
Sentry
Purpose: application error monitoring and release diagnostics when enabled. Data: minimized technical error, route, release and device information. Customer-site visitor input, request bodies and raw browser dumps are not intentionally sent. The current account is hosted in the United States.
PostHog
Purpose: optional SiteAirbag app product analytics only after an affirmative choice. Data: explicit minimized events, including one page-view event per public SiteAirbag page (the page path without its query string, the referring website's domain, and campaign labels such as utm_source) and which marketing buttons were used, and, for signed-in users, a stable account ID without name or email. PostHog's automatic page views, exception capture, autocapture and session recording are disabled; addresses sent with events have their query string and fragment removed. It is not loaded by the customer-site runtime and is disabled before the required choice. The current project is hosted in the United States.
Sanity (blog content and images)
Purpose: the content editor for SiteAirbag's blog and the image network that serves blog pictures. Data: when an article includes a picture, your browser requests it from Sanity (cdn.sanity.io), so Sanity receives your IP address and browser information as the image host. SiteAirbag's server reads published articles from Sanity without sending any visitor data, and no account, customer, runtime or rescue data is sent to Sanity. Articles without pictures load nothing from Sanity. Added 12 oct 2026: Sanity's contracting entity, data region and retention of image-request logs are being verified.
Meta Platforms (optional advertising measurement)
Purpose: measuring whether SiteAirbag's own advertising led to website visits, checkouts, free trials, account setup or purchases, only where the visitor's regional rule and privacy choice allow it (never in the EEA or United Kingdom). Data: public-page addresses, IP address and browser information, the _fbp and _fbc identifiers, user agent, country, the plan selected, for checkout and free-trial events the billing interval, whether it is a free trial or a paid start, the trial length and the plan's listed first-payment price, for checkout, free-trial, account setup and purchase events a SHA-256 hash of the checkout email address and a pseudonymous buyer identifier derived from it, and for a purchase the amount excluding tax and the currency; never names, readable email addresses, phone numbers, passwords, account or workspace identifiers, other typed content or customer-website data. Under Meta's Business Tools Terms, Meta acts on SiteAirbag's behalf for measurement and matching services and on its own behalf for other uses of Meta business tool data. The Meta contracting entity for SiteAirbag is the one named in those terms for its location.
Google (optional advertising measurement for YouTube ads)
Purpose: measuring whether SiteAirbag's own advertising on YouTube led to website visits, checkouts, free trials or purchases, only where the visitor's regional rule and privacy choice allow it (never in the EEA or United Kingdom). It is for measurement only: SiteAirbag tells Google not to use it for ad personalisation. Data: public-page addresses and the address you came from, IP address and browser information collected by Google's script, first-party cookies that script sets, the Google ad-click identifier from the address you arrived on, for free-trial and purchase events a SHA-256 hash of the checkout email address, the time of the event and a hashed transaction identifier, and for a purchase the amount excluding tax and the currency; never names, readable email addresses, phone numbers, passwords, account or workspace identifiers, other typed content or customer-website data. Which Google company contracts with SiteAirbag depends on the billing country of its Google Ads account, and Google's role for this data is described in the terms for that account.
Locations and changes
Last verified 10 sep 2026. Exact vendor legal entities, contract safeguards and retention periods that are not stated above remain subject to provider account and contract verification. Material additions or replacements will be posted here and emailed to workspace owners at least seven days before use where reasonably practicable, subject to the urgent-change exceptions in the DPA. Legitimate data-protection objections may be sent to privacy@siteairbag.com within 14 calendar days.
Questions or requests
Support: support@siteairbag.com
Privacy: privacy@siteairbag.com
Security: security@siteairbag.com
Legal: legal@siteairbag.com