1. Overview
The sub-processors below support TopAdsROI's own systems — this marketing site, the admin panel, the demo CRM, and billing. Customer end-user data does not leave the customer's own cloud and never reaches any sub-processor on this list; they see only metadata (service health, billing) or website-visitor data (demo requests).
Why your cloud provider is not listed here. In our BYOC model the customer deploys into their own cloud — Google Cloud, AWS, Azure, or private — and contracts directly with that provider (under the provider's own DPA). The cloud provider is therefore the customer's provider, not a TopAdsROI sub-processor. Likewise, the ad platforms the customer dispatches to — Meta, TikTok, LINE, Google Ads, LinkedIn — are the customer's sub-processors under GDPR Art. 28, chosen and controlled by the customer. We recommend customers list both in their own privacy notice.
2. Current sub-processors
| Provider | Purpose | Data | Region |
|---|---|---|---|
| Cloudflare | CDN, DDoS protection, Workers, Pages hosting (this marketing site + admin panel) | IP, request metadata, WAF logs | Global edge |
| HubSpot | CRM and demo request workflow | Demo form submissions (name, email, company, role, market) | United States |
| Slack | Internal team notifications | No PII. Aggregated counts only | United States |
| Sentry | Error monitoring | Stack traces (PII scrubbed); session IDs | United States |
| Stripe | Subscription billing — automated billing plans only (enterprise wire-transfer customers excluded) | Billing contact and payment instrument | United States |
3. Notification of changes
We notify customers at least 30 days in advance of any new sub-processor (or material change to an existing one). Notification channels:
- Email to your designated DPO contact.
- This page is the canonical source — diff-able via the version number above.
- Customers may object during the 30-day window; we work in good faith to find an alternative.
