Subprocessors
Everyone who touches Simplytics data, what each gets, and where. Companies that process personal data for us come first; companies your browser contacts or that monitor the site come second.
Subprocessors
Companies that store or process personal data to run the service. Dodo Payments, as merchant of record, decides how it uses payment data under its own privacy policy.
| Company | What it does | What it gets | Where |
|---|---|---|---|
| Cloudflare | Hosting, the database, the weekly backups, and the edge that serves every page and beacon | Everything — the analytics aggregates, account emails, the raw visit rows for the hours before they are deleted, the weekly backups, operational logs until 2026-10-23, and three months of per-request public-dashboard performance records without site or visitor identifiers | The database (Warsaw) and the stored backups are in the EU. Requests are served from the nearest edge location worldwide. The job that makes and checks each weekly backup runs wherever Cloudflare places it, and operational logs and public-dashboard performance records are kept wherever Cloudflare stores them; both may be outside the EU |
| Dodo Payments | Merchant of record for subscriptions | Your billing email and payment details. We never see card numbers | Dodo is an independent controller of payment data as merchant of record. Its privacy policy says it transfers data within its group and to payment providers in other countries, using Standard Contractual Clauses for transfers from the EEA and UK |
| Resend | Sends every automated email: the weekly digest, spike alerts, onboarding, billing and quota notices, and sign-in links | Your email address and the contents of those messages. Never any visitor data | United States: Resend's own systems, under its data-processing agreement, which relies on Standard Contractual Clauses, the UK Addendum and the EU–US Data Privacy Framework. Delivery goes through Amazon SES in eu-west-1 (Ireland) |
| GitHub (Microsoft) | Hosts the source code and the operator's working notes, and runs the automated tests and deploys. From 2026-09-05 to 2026-09-23 it also ran the weekly backup, which now runs on Cloudflare | The code, and notes with a few account holders' email addresses and details of fixes to their accounts or billing. No copy of the database and no backups. The deploy job holds a Cloudflare credential that can replace the main site's code and read and change its database. Misused, it could read customer data, including the stored backups, because the main site's code can be given access to the backup storage without further permission; see the security page | GitHub's servers and GitHub-hosted machines, whose location is not guaranteed to be in the EU; under GitHub's own terms |
| Apple (iCloud Mail) | Hosts the @simplytics.dev mailboxes, including nikhil@simplytics.dev | Every email you send us and our replies: your address and whatever the message contains, such as support, refund or data-protection requests. No visitor data unless you put it in a message | Wherever Apple stores iCloud Mail, which is not guaranteed to be in the EU; under Apple's own terms |
Scroll the table sideways to see the last two columns.
Other companies involved
These companies are not in the table above. Pages on simplytics.dev make your browser load files from some of them, and Better Stack runs our status monitoring. Our tracking script does not contact any of them from a site you track.
- DuckDuckGo — your browser fetches website icons from
icons.duckduckgo.com: for referring sites in any dashboard's Top Sources list, including public dashboards and the demo; for your own sites in the dashboard and account pages; and for a website you type on the home page, the sign-in page or when adding a site. Each request tells DuckDuckGo that website's name and your IP address. - jsDelivr — serves the charting library every dashboard draws with, including public dashboards and the demo, pinned to an exact version and checked against a hash. Loading it tells jsDelivr your IP address.
- Better Stack — hosts our status page at
status.simplytics.dev, requests/healthevery three minutes, and receives a success or failure signal from our servers when each scheduled job finishes. Neither contains account or visitor data. Opening the status page connects your browser to Better Stack. - Google — Cloudflare currently serves our Google Fonts from simplytics.dev. If that rewrite does not apply, your browser loads them from Google, which receives your IP address and simplytics.dev as the referrer.
And the person who runs it
Simplytics is run by one person based in India, who administers the EU-hosted database from there. For an EU customer controller, giving that remote access to an India-based processor can be an international transfer even when the database stays in the EU. The DPA covers it with the EU Standard Contractual Clauses and a transfer assessment, and the privacy policy explains what is still missing.
What is deliberately absent
No advertising network, data broker, session-recording tool or third-party analytics script runs on simplytics.dev. We count our own site's visits with Simplytics itself, on the providers listed above, and no other subprocessor receives that data; the privacy policy explains. No AI service is part of the product. A visitor to a site you track is never in contact with anything except Cloudflare's edge.
The operator's own tools
A correction: this page used to say “no AI vendor”. The service uses none, but the person running it uses AI coding assistants: Anthropic's Claude Code and OpenAI's Codex. Until 2026-09-23 they sometimes read account data (email addresses, billing status and payment records) and a little analytics data from the production systems while debugging. Since 2026-09-23 the operator's rule limits AI assistants to counts, database structure and log field names. On 2026-09-29 the Claude Code guard was extended to reject all Workers Logs queries and values and all Cloudflare code-mode calls, which it previously allowed. Codex follows the written rule, not that guard.
Changes
Before we add or replace a subprocessor, we email every account holder at least 30 days ahead, as the DPA sets out, and update this page, /privacy and the changelog.