Subprocessors
Everyone who touches Simplytics data, what each one gets, and where they sit. Two lists, because the distinction is real and most pages of this kind blur it.
Subprocessors
Companies that store or process personal data to run the service, and what each one gets. Dodo Payments, as merchant of record, decides how it uses payment data under its own privacy policy.
| Company | What it does | What it gets | Where |
|---|---|---|---|
| Cloudflare | Hosting, the database, the weekly backups, and the edge that serves every page and beacon | Everything — the analytics aggregates, account emails, the raw visit rows for the hours before they are deleted, the weekly backups, three days of operational logs, and three months of per-request public-dashboard performance records without site or visitor identifiers | The database (Warsaw) and the stored backups are in the EU. Requests are served from the nearest edge location worldwide, and the job that makes and checks each weekly backup runs wherever Cloudflare places it, which may be outside the EU. Operational logs and public-dashboard performance records are kept wherever Cloudflare stores them, which may also be outside the EU |
| Dodo Payments | Merchant of record for subscriptions | Your billing email and payment details. We never see card numbers | Dodo is an independent controller of payment data as merchant of record. Its privacy policy says it transfers data within its group and to payment providers in other countries, using Standard Contractual Clauses for transfers from the EEA and UK |
| Resend | Sends every automated email: the weekly digest, spike alerts, onboarding, billing and quota notices, and sign-in links | Your email address and the contents of those messages. Never any visitor data | United States: Resend's own systems, under its data-processing agreement, which relies on Standard Contractual Clauses, the UK Addendum and the EU–US Data Privacy Framework. Delivery goes through Amazon SES in eu-west-1 (Ireland) |
| GitHub (Microsoft) | Hosts the source code and the operator's working notes, and runs the automated tests and deploys. From 2026-09-05 to 2026-09-23 it also ran the weekly backup, which now runs on Cloudflare | The code, and notes that include a few account holders' email addresses and details of fixes to their accounts or billing. No copy of the database and no backups. The deploy job holds a Cloudflare credential that can replace the main site's code and read and change its database. Misused, it could read customer data, including the stored backups, because the main site's code can be given access to the backup storage without any further permission; the security page explains | GitHub's servers and GitHub-hosted machines, whose location is not guaranteed to be in the EU; under GitHub's own terms |
| Apple (iCloud Mail) | Hosts the @simplytics.dev mailboxes, including nikhil@simplytics.dev | Every email you send us and our replies: your address and whatever the message contains, such as support, refund or data-protection requests. No visitor data unless you put it in a message | Wherever Apple stores iCloud Mail, which is not guaranteed to be in the EU; under Apple's own terms |
Scroll the table sideways to see the last two columns.
Other companies involved
These companies are not in the table above. Pages on simplytics.dev tell your browser to load files from some of them, and Better Stack runs our status monitoring. Our tracking script does not contact any of them from a site you track.
- DuckDuckGo — your browser fetches website icons from
icons.duckduckgo.com: for referring sites in any dashboard's Top Sources list, including public dashboards and the demo; for your own sites in the dashboard; and for a website you type on the home page, the sign-in page or when adding a site. Each request tells DuckDuckGo that website's name and your IP address. - jsDelivr — serves the charting library every dashboard draws with, including public dashboards, pinned to an exact version and checked against a hash. Loading it tells jsDelivr your IP address.
- Better Stack — hosts our status page at
status.simplytics.dev, requests/healthevery three minutes, and receives a success or failure signal from our servers when each scheduled job finishes. Neither contains account or visitor data. Opening the status page connects your browser to Better Stack. - Google — Cloudflare currently serves our Google Fonts from simplytics.dev. If that rewrite does not apply, your browser loads them from Google, which receives your IP address and simplytics.dev as the referrer.
And the person who runs it
Not a company, so not a row in either table — but the honest answer to “who can reach my data” is a person, not only a vendor list. Simplytics is run by one person based in India, who administers the EU-hosted database from there. For an EU customer controller, giving that remote access to an India-based processor can be an international transfer even when the database stays in the EU. The DPA covers it with the EU Standard Contractual Clauses and a transfer assessment, and the privacy policy explains what is still missing.
What is deliberately absent
No advertising network, no data broker, no session-recording tool, and no third-party analytics script on simplytics.dev. Our own-site counting is first-party. It runs on the same infrastructure providers listed above, and no additional subprocessor receives this data. The privacy policy explains this. No AI service is part of the product. A visitor to a site you track is never in contact with anything except Cloudflare's edge.
The operator's own tools
A correction, and not in our favour. This page used to say “no AI vendor”. The service uses none, but the person running it uses AI coding assistants: Anthropic's Claude Code and OpenAI's Codex. Until 2026-09-23 they sometimes read account data (email addresses, billing status and payment records) and a little analytics data from the production systems while debugging. Since 2026-09-23 the operator's rule limits AI assistants to counts and database structure; field-name-only log keys are also allowed. On 2026-09-29 the Claude Code guard was extended to reject all Workers Logs queries and values and all Cloudflare code-mode calls, which it previously allowed. Codex follows the written rule rather than that hook.
Changes
Before a subprocessor is added or replaced, every account holder is emailed at least 30 days ahead, as the DPA sets out, and the change is made on this page, on /privacy and on the changelog.