List of Subprocessors
Last Updated: August 17, 2026
Note (August 17, 2026): Three corrections, two of them about where processing actually happens. Hetzner was added. The application itself — the API backend, the web app it serves, the ingress in front of both, and the hosted files still sitting on local disk from before the move to Backblaze — runs on a virtual server we rent, and a subprocessor list that names the database host but not the machine running the software is not a list of our subprocessors. The Cloudflare entry stopped claiming that no scanner logs are kept at the edge: the redirect worker writes one line per scan, log storage is switched on in the deployment, and since the consent banner shipped that line also records the scanner's answer about the retargeting pixel. Section 1.1 sets out exactly what is in those lines, what is not, and how long Cloudflare keeps them. The word "stateless" went with the claim — a scan that is waiting on the consent banner is parked in Cloudflare's edge cache for up to ten minutes. And Umami was added: the analytics script has been running on every page of the site and the application, and the Cookie Policy has named it since June, but this list — the one document whose whole job is to name every third party that processes data — did not.
Note (August 13, 2026): Backblaze was added — it holds the files uploaded through the file-hosting add-on. The Base L2 entry was corrected: it previously described "encrypted QR code mapping metadata", which does not exist as a separate thing; what is written is a random identifier plus the encrypted destination, and only for paid Eternal codes.
To deliver our Service, eqr.link engages third-party infrastructure and service providers who may process personal data on behalf of our customers. Under data protection regulations (such as GDPR Article 28), these providers are classified as Subprocessors.
We require all engaged subprocessors to maintain strict data security standards and adhere to data protection agreements (including Standard Contractual Clauses where applicable).
1. List of Active Subprocessors
The following table lists the active subprocessors engaged by the Company:
| Subprocessor Name | Corporate Entity | Purpose | Hosting/Processing Location | Transfer Safeguard / Notes |
|---|---|---|---|---|
| Turso (LibSQL) | Chiselstrike, Inc. | Relational database hosting for accounts, QR codes, billing ledger, and analytics. | European Union (EU) | Primary data storage. |
| Hetzner | Hetzner Online GmbH | The virtual server the application runs on: the API backend, the web app it serves, the TLS ingress in front of both, and hosted files uploaded before the move to Backblaze, which are still on its local disk. | Finland (EU) | No transfer outside the EEA — the server's address range is registered to Hetzner with Finland as its country. Hetzner Online GmbH is established in Germany. |
| Cloudflare | Cloudflare, Inc. | Content Delivery Network (CDN), edge routing, workers redirect execution, and DDoS mitigation. | Global (Edge locations nearest to scanner) | Standard Contractual Clauses (SCCs). The edge keeps no database, but it does keep logs and a short-lived cache entry — see Section 1.1. |
| Stripe | Stripe, Inc. | Payment processing and billing checkout management. | United States (US) | EU-U.S. Data Privacy Framework / SCCs. Processes billing credentials and payment tokens. |
| Resend | Resend, Inc. | Transactional email delivery (magic login links). | United States (US) | Standard Contractual Clauses (SCCs). |
| Google LLC | Google Sign-in OAuth 2.0 authentication service. | United States (US) | EU-U.S. Data Privacy Framework / SCCs. | |
| Umami | Umami Software, Inc. | Website usage analytics. Its script is loaded on every page of eqr.link and of the web application, and reports page views back to the hosted Umami Cloud service. | Umami Cloud (cloud.umami.is) | Standard Contractual Clauses (SCCs) for any processing outside the EEA. Cookieless: it sets no cookie and stores no individual IP address — Section 2.2 of the Cookie Policy describes what it collects. |
| Backblaze | Backblaze, Inc. | Private object storage for files uploaded through the file-hosting add-on. | United States (US) | Standard Contractual Clauses (SCCs). Bucket-scoped credentials; no public listing. |
| Base L2 Network | Decentralized Network | Immutable anchoring of the random QR identifier and the encrypted destination, for paid Eternal codes only. | Global / Public Blockchain | Ciphertext and a random identifier only — no email, account identifier, IP or plaintext destination. Immutable public ledger; entries cannot be deleted. |
1.1. What the edge keeps
This page used to say that the edge kept no scanner logs. It does, and here is what they contain.
The redirect worker writes one short line to Cloudflare's log for every scan it serves, and log storage is enabled on the deployment, so those lines are retained rather than discarded as they are printed. A scan of an ordinary code produces two values: the first four characters of the code's identifier, and the two-letter country code Cloudflare derives from the scanner's IP address. A scan of a code that carries a retargeting pixel produces the same two values plus the first eight characters of the pixel's identifier and the scanner's answer to the consent banner — accepted, declined, or not yet answered. Nothing else is in the line: no raw IP address, no email address, no account identifier, no destination URL. The worker writes a handful of other lines — a scan it has to resolve a second time, a failure to reach our own backend, a storage error while serving a hosted file. Those carry a description of what went wrong, and the same truncated identifier where the code is known; none of them carries anything about the scanner. Cloudflare additionally records the request metadata its own platform captures for every worker invocation, under its terms as our subprocessor.
Cloudflare's documented maximum retention for these logs is seven days, after which they age out on its side. We do not configure a longer period, and we do not copy or export them to any other destination.
One further piece of edge state, since "stateless" is no longer the right word: when a scanner is shown the consent banner, the scan that produced it — the destination URL and the code's feature settings — is held in Cloudflare's edge cache for up to ten minutes, addressed by a random token that only that banner's two links carry. It exists so that answering the banner does not have to be counted as a second scan of the same physical code. It holds no identifier of the scanner and expires on its own.
2. Notification of Changes to Subprocessors
We maintain this page to provide transparency regarding our subprocessors. If we plan to engage a new subprocessor or replace an existing one:
- We will update this page at least 30 days prior to engaging the subprocessor.
- Registered customers on paid plans may subscribe to email notifications for subprocessor changes by contacting support@eqr.link.
- Right to Object: Customers may object to the engagement of a new subprocessor on reasonable grounds related to data protection by submitting a written objection to support@eqr.link within 14 days of the notification.