Subprocessors
This is the list of third parties that process personal data on behalf of ZANTEMARK LIMITED to provide vbtnl. It forms Annex III of our Data Processing Agreement. We announce additions and replacements at least 30 days in advance by email and in the dashboard; customers may object as described in Section 5 of the DPA.
Infrastructure
| Provider | Purpose | Data | Location | Transfer mechanism | Contract |
|---|---|---|---|---|---|
| Bolton Technologies Ltd | Physical servers and datacenter hosting the whole platform: customer accounts, Projects, databases, backups | All platform data | 195 Makarios III Avenue, 3608 Limassol, Cyprus | None needed (EU) | Service agreement and Article 28 DPA |
| Cloudflare, Inc. | Network edge: DNS, TLS termination, DDoS protection, tunnel into the platform, custom hostnames for customers’ domains, Turnstile anti-bot check | IP addresses, request metadata, TLS certificates for customer domains | EU edge locations; company in the United States | EU-US Data Privacy Framework certification; Cloudflare DPA with SCCs | Cloudflare Data Processing Addendum |
Platform services
| Provider | Purpose | Data | Location | Transfer mechanism | Contract |
|---|---|---|---|---|---|
| Resend, Inc. | Sending transactional email: verification, password reset, copies of agreements, notices | Email address, name, email content | United States | Standard Contractual Clauses (Resend DPA) | Resend Data Processing Agreement |
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Payments, invoices, subscription billing, tax calculation | Billing name and address, email, card data (entered directly with Stripe), VAT number, invoice history | Ireland and United States | Stripe acts as an independent controller for payment processing (Stripe Privacy Policy) and as processor for customer records (Stripe DPA, SCCs / DPF) | Stripe Services Agreement and DPA |
| Google LLC (Sign in with Google) | Optional sign-in | Google account ID, email, name | United States | Google is a controller of its own sign-in processing; DPF certified | Google Terms |
Analytics (vbtnl.com only, after consent)
| Provider | Purpose | Data | Location | Transfer mechanism | Contract |
|---|---|---|---|---|---|
| Google LLC (Google Analytics 4) | Website statistics, only for visitors who accept analytics cookies | Pseudonymous visitor ID (cookie), pages viewed, truncated IP, device data | United States | EU-US Data Privacy Framework; Google Ads Data Processing Terms | Google Analytics Terms, Data Processing Terms |
Internal tools
| Provider | Purpose | Data | Location | Transfer mechanism | Contract |
|---|---|---|---|---|---|
| Telegram FZ-LLC | Security alerts to our own team about sign-ins to our admin tools; no customer data is sent | Name and IP address of our own staff member | United Arab Emirates | Not applicable: no customer personal data | Telegram Terms |
Not sub-processors
Your AI Assistant’s provider (for example Anthropic, PBC for Claude; OpenAI; Google for Gemini): you connect your assistant with your own account; it reads your Projects and sends data to its provider on your instruction. We are not party to that processing and it is not covered by our DPA.
Version 2026-11-09. Changes: see the version history in the dashboard under Legal.