Vendor sheets
GDPR for your SaaS stack
Sixty-four tools a SaaS actually connects: Supabase, Vercel, Stripe, Clerk, Resend, and also Hotjar, Webflow, Pipedrive, Pennylane, Zendesk, Loops. Each entry answers three questions: the DPA, further processors, and transfers outside the EU.
Next.js is not in the list: it is the framework, not a processor. The page says so, then points to the host.
Facts come from official pages, with the URL and the date. Checked on 4 October 2026 for the first fifty entries, and on 5 October 2026 for the fourteen added later. What was not read is written “not disclosed”. This is not a compliance opinion, and it is not legal advice.
Stack combinations
Two pages reuse entries that are already published (location, DPA, further processors, transfer mechanism) and say, in this language, what a SaaS on that stack should write in its privacy policy. See all combinations.
Frequently asked questions
Are these sheets a compliance opinion?
No. Each sheet copies what an official page says about the entity, the role, the location, the DPA, and the further sub-processors. What has not been read is written “not disclosed”. This is not legal advice.
Must Next.js be declared as a processor?
No. Next.js is the framework. You name the host that runs the application, often Vercel, and the other vendors that see data. The Next.js GDPR page points to these sheets.
Where are the DPA, the sub-processors, and transfers outside the EU?
On the tool sheet, under the headings DPA, Sub-processors, and Transfers outside the EU. The stack pages assemble several sheets for a common combination.
Hosting and network
Where the pages, the functions, and the logs are processed, and whether a DPA is published.
- GDPR Vercel — Hosting, CDN, and front-end deployments.
- GDPR Netlify — Hosting for sites and functions.
- GDPR Cloudflare — DNS, CDN, WAF, and bot protection.
- GDPR AWS — Cloud infrastructure (compute, storage, databases).
- GDPR OVHcloud — Hosting and cloud, often chosen for a French entity.
- GDPR Scaleway — European cloud (compute, storage, databases).
- GDPR Hetzner — Servers and cloud, often in Germany.
- GDPR Render — Hosting for applications, static sites, and databases.
- GDPR Railway — Hosting for applications and databases.
- GDPR Fly.io — Hosting for machines and applications, close to users.
- GDPR Webflow — Site creation and hosting.
Data
Databases and storage: chosen region, DPA, further sub-processors.
- GDPR Supabase — Postgres database, authentication, and storage.
- GDPR Firebase — Google application backend (auth, database, storage).
- GDPR Neon — Serverless Postgres.
- GDPR PlanetScale — Managed MySQL database.
- GDPR MongoDB Atlas — Managed document database.
- GDPR Upstash — Serverless Redis, Kafka, and queues.
Authentication
Accounts and sessions. The DPA and the location of the tenants are not those of the framework.
- GDPR Clerk — Authentication and user accounts.
- GDPR Auth0 — Authentication and identity management.
Payment
Payment collection. The signing entity often changes with the country of the account.
- GDPR Stripe — Payment and billing.
- GDPR Paddle — Merchant of record for software sales.
- GDPR Lemon Squeezy — Sale of digital products.
- GDPR Gumroad — Sale of digital products and checkout.
Transactional or marketing email, and transfer of message content.
- GDPR Resend — Transactional emails.
- GDPR Postmark — Transactional emails.
- GDPR SendGrid — Transactional and marketing emails (Twilio).
- GDPR Brevo — Marketing and transactional emails.
- GDPR Mailchimp — Marketing emails and audiences.
- GDPR Mailjet — Transactional emails and campaigns.
- GDPR Loops — Transactional and marketing emails.
Collaboration
Team tools that see documents and accounts.
- GDPR Notion — Notes, wikis, and team documents.
- GDPR Slack — Team messaging.
- GDPR Google Workspace — Messaging, documents, and organization identity.
- GDPR Microsoft 365 — Microsoft messaging, documents, and identity.
- GDPR Linear — Product ticket tracking.
- GDPR Figma — Interface design and prototypes.
Support and CRM
Support, chat, and CRM: conversations and contact records.
- GDPR HubSpot — CRM, forms, and sales tracking.
- GDPR Intercom — Support chat and messaging.
- GDPR Crisp — Support chat.
- GDPR Pipedrive — CRM and sales pipeline.
- GDPR Zendesk — Customer support and help center.
Measurement and observability
Audience measurement and cookies placed on your domain.
- GDPR Plausible — Audience measurement without cookies.
- GDPR Google Analytics — Audience measurement.
- GDPR PostHog — Product analytics and events.
- GDPR Mixpanel — Product analytics.
- GDPR Sentry — Application error tracking.
- GDPR Datadog — Observability and logs.
- GDPR Matomo — Audience measurement, in the cloud or on your servers.
- GDPR Hotjar — Heatmaps, session recordings, and surveys.
AI models
Model APIs: prompts, attachments, transfers outside the EU.
- GDPR OpenAI — Model inference via the API.
- GDPR Anthropic — Model inference via the API.
- GDPR Mistral — Model inference via the API.
Tools and automation
Forms, automation, appointments.
- GDPR GitHub — Code repositories, issues, and Copilot depending on the plan.
- GDPR Calendly — Appointment scheduling.
- GDPR Typeform — Forms.
- GDPR Tally — Forms.
- GDPR Zapier — Automation between applications.
- GDPR Make — Automation between applications.
- GDPR Airtable — Shared bases and tables.
- GDPR Algolia — Search in the application.
- GDPR Cal.com — Appointment scheduling.
Banking and commerce
Banking, invoicing, and accounting.
- GDPR Qonto — Business account and payments.
- GDPR Shopify — Online store.
- GDPR Pennylane — Accounting and invoicing.
Find an entry
64 sheets
Hosting and network
Vercel
Vercel Inc.
DPF active
Hosting and network
Netlify
Netlify, Inc.
DPF active
Hosting and network
Cloudflare
Cloudflare, Inc.
DPF active, review in progress
Hosting and network
AWS
Amazon Web Services, Inc.
DPF active
Hosting and network
OVHcloud
OVH SAS (French policy); the DPA published on the US site is concluded with OVH US LLC dba OVHcloud
DPF active
Hosting and network
Scaleway
Scaleway, S.A.S.
DPF not registered
Hosting and network
Hetzner
Hetzner Online GmbH
DPF not registered
Data
Supabase
Supabase Pte. Ltd
DPF not registered
Data
Firebase
For Firebase Paid Services, the entity is the one in the contracting-entities table for the billing address: Google Cloud France (8 Rue de Londres, Paris 75009) if it is in France; Google Cloud EMEA Limited for EMEA outside France, Italy and Poland; Google Cloud Italy S.r.l. in Italy; Google Cloud Poland Sp. z o.o. in Poland; Google LLC for the United States and any place not listed.
DPF active
Data
Neon
Neon Inc. (DPA); Neon, LLC, a subsidiary of Databricks, Inc. (platform terms and sub-processor page)
DPF active
Data
PlanetScale
PlanetScale, Inc.
DPF active
Payment
Stripe
Stripe Payments Europe, Limited for accounts outside North and South America; Stripe, LLC for accounts located in North or South America
DPF active
Payment
Paddle
Paddle.com Inc. (DPA) ; la politique cite aussi Paddle.com Market Limited, Paddle Payments Limited et Paddle.com Canada Ltd. comme responsables
DPF not registered
Payment
Lemon Squeezy
Sold through Link, LLC, formerly Lemon Squeezy LLC
DPF not registered
Payment
Gumroad
Gumroad, Inc.
DPF not registered
Email
Resend
Plus Five Five, Inc.
DPF active, review in progress
Email
Postmark
AC PM, LLC
DPF active
Email
SendGrid
Twilio Inc.
DPF active
Email
Brevo
Sendinblue, a French SAS operating as Brevo, registered in Paris under number 498 019 298
DPF active
Email
Mailchimp
The Rocket Science Group LLC d/b/a Mailchimp
DPF active
Collaboration
Notion
Notion Labs, Inc.
DPF active, review in progress
Collaboration
Slack
Slack Technologies, LLC for workspaces in the United States and Canada; Slack Technologies Limited for workspaces outside the United States and Canada
DPF active
Collaboration
Google Workspace
For a Google Workspace contract, the contracting-entities page defines “Google” according to the billing address: Google Cloud France (8 Rue de Londres, Paris 75009) if it is in France; Google Cloud EMEA Limited for EMEA outside France, Italy and Poland; Google Cloud Italy S.r.l. in Italy; Google Cloud Poland Sp. z o.o. in Poland; Google LLC for the United States and any place not listed.
DPF active
Collaboration
Microsoft 365
Microsoft Corporation et Microsoft Ireland Operations Limited
DPF active, review in progress
Tools and automation
GitHub
GitHub, Inc.
DPF active
Collaboration
Linear
Linear Orbit, Inc.
DPF not registered
Collaboration
Figma
Figma, Inc.
DPF active
Support and CRM
HubSpot
HubSpot, Inc.
DPF active
Support and CRM
Intercom
Intercom, Inc.
DPF active
Support and CRM
Crisp
Crisp IM SAS
DPF not registered
Measurement and observability
Plausible
Plausible Insights OÜ
DPF not registered
Measurement and observability
Google Analytics
Google LLC, Google Ireland Limited, or any other affiliate of Google LLC
DPF active
Measurement and observability
PostHog
PostHog, Inc.
DPF active
Measurement and observability
Mixpanel
Mixpanel, Inc.
DPF active
Measurement and observability
Sentry
Functional Software, Inc. d/b/a Sentry
DPF active
Measurement and observability
Datadog
Datadog, Inc.
DPF active
Authentication
Clerk
Clerk, Inc.
DPF active
Authentication
Auth0
Okta, Inc.
DPF active
AI models
OpenAI
OpenAI Ireland Ltd for a customer established in the EEA or Switzerland; OpenAI OpCo, LLC otherwise
DPF not registered
AI models
Anthropic
Anthropic PBC; Anthropic Ireland, Limited is the controller of personal data in the consumer policy for the EEA, the United Kingdom and Switzerland
DPF not registered
AI models
Mistral
Mistral AI, a French company registered in Paris under number 952 418 325, 15 rue des Halles, 75001 Paris
DPF not registered
Tools and automation
Calendly
Calendly, LLC
DPF active
Tools and automation
Typeform
Typeform SL
DPF not registered
Tools and automation
Tally
Tally BV
DPF not registered
Tools and automation
Zapier
Zapier, Inc.
DPF active
Tools and automation
Make
Celonis, Inc.
DPF active
Tools and automation
Airtable
Formagrid Inc
DPF not registered
Banking and commerce
Qonto
Qonto SA
DPF not registered
Banking and commerce
Shopify
Shopify International Ltd. (Ireland) receives data of people located in the EEA, the United Kingdom or Switzerland; Shopify Inc. (Canada) depending on location
DPF inactive
Tools and automation
Algolia
Algolia SAS for subscribers in Europe; Algolia, Inc. for subscribers outside Europe
DPF not registered
Hosting and network
Render
Render Services, Inc.
DPF active
Hosting and network
Railway
Railway Corporation
DPF not disclosed
Hosting and network
Fly.io
Fly.io, Inc.
DPF not disclosed
Data
MongoDB Atlas
MongoDB, Inc. (importer of the standard contractual clauses, for itself and its affiliates outside the EEA)
DPF not disclosed
Data
Upstash
Upstash, Inc., a Delaware company
DPF not disclosed
Measurement and observability
Matomo
InnoCraft Ltd, 7 Waterloo Quay, PO Box 625, 6140 Wellington, New Zealand
DPF not registered
Email
Mailjet
The policy presents itself as Sinch Email (brands Mailgun, Mailgun Optimize, Mailjet and Email on Acid) and states that processing may be carried out by Sinch Email or other controllers in the group. The Sinch sub-processor list names Mailjet SAS, 43 rue de Dunkerque, 75010 Paris, for Mailjet support and operations. The published DPA is concluded with the Sinch entity of the contract.
DPF active
Tools and automation
Cal.com
Cal.com, Inc.
DPF not disclosed
Measurement and observability
Hotjar
For a Hotjar order form (Ask, Observe or Engage), the entities table indicates Content Square SAS, 7 rue de Madrid, 75008 Paris, if the customer is not domiciled in the Americas, and Content Square, Inc., 60 Hudson St, New York, NY 10013, for the Americas (except Cuba).
DPF not disclosed
Hosting and network
Webflow
Webflow, Inc.
DPF active
Support and CRM
Pipedrive
Pipedrive, Inc. is the US recipient named in the DPA. The notice refers to Pipedrive, Inc. and its affiliates. Legal name of the entity that signs for a European Union customer: not disclosed.
DPF not disclosed
Banking and commerce
Pennylane
Pennylane, a SAS registered with the RCS of Cherbourg under number 880 265 921, registered office 3 rue de Franche Comté, 50100 Cherbourg-en-Cotentin (general terms cited, version of 26 September 2023).
DPF not disclosed
Support and CRM
Zendesk
Zendesk, Inc.
DPF not disclosed
Email
Loops
Astrodon Corporation (Loops)
DPF not disclosed
The clause does not replace the pack
These entries feed the processors section. The 39 € pack (incl. VAT) adds the legal notice, terms of use, terms of sale, the full privacy policy and the Article 28 DPA, naming only the tools you tick. One-time payment, Markdown ZIP and App Router pages.