Subprocessors

This directory distinguishes providers appointed for hosted-service processing, providers used for OrbitPage own controller purposes, customer-contracted services and links or embedded content chosen by users. The DPA authorises only the subprocessors involved in customer-controlled processing. A service name is not evidence of commercial partnership or joint controllership. Official provider terms identify the contracting entity, onward subprocessors and safeguards for the relevant account and service.

The configured services below transmit account, platform, support, withdrawal or Shop email for the stated channel. Where Purelymail (Add Rabbit LLC) is the configured transport, it handles recipient/sender addresses, message bodies, attachments and delivery/security metadata. Its public privacy notice does not specify an exclusive EEA processing location. Relevant processing terms, location and transfer safeguards depend on the contracted email service and can be requested through the OrbitPage privacy contact. Purelymail privacy.

PostHog, Inc. provides consent-gated platform product analytics, redacted browser error tracking and masked recordings of selected editor sections through PostHog Cloud EU. It receives pseudonymous browser, account and session identifiers, product and device metadata, limited technical error frames and masked interactions. Customer text and inputs are masked; layout, bundled styles, standard icons and static navigation remain visible. It does not receive OrbitPage's customer-page traffic or intentional copies of page content, prompts, credentials or payment details. This processing is separate from tenant Analytics Engine reporting: PostHog processes data for OrbitPage's own controller purposes, rather than acting as a subprocessor for customer-page analytics.

Requests use t.orbitpage.com and PostHog's Cloudflare-based managed reverse proxy. Cloudflare handles network and request information for that delivery; the proxy removes the Cookie header before forwarding to PostHog. The EU ingestion configuration does not imply that every network, support or provider operation occurs exclusively in the EU. PostHog's DPA and subprocessor disclosures describe applicable locations and transfer safeguards.

Privacy policy · Data processing agreement and subprocessors · Managed proxy processing

Resend (Plus Five Five, Inc.) sends optional OrbitPage welcome, tips and reminder email to consenting accounts and may also supply the dedicated account-email transport when configured. It processes email addresses, language, message content, delivery events and suppression status. It is a processor for OrbitPage controller activities and, if used for customer-controlled Shop messages, a subprocessor for that purpose. It has US-based operations and onward providers; location and transfer safeguards follow the contracted service, not the language of an email.

Privacy · DPA · Subprocessors

Where configured, an operator-managed n8n deployment routes contact submissions and related support notifications. n8n is workflow software in that configuration; its licence alone does not make n8n GmbH a recipient of every message. The workflow host and any downstream mail or infrastructure provider must be included in the actual processing arrangement. The public AI guide uses the OrbitPage server and OpenAI directly and does not send chat conversations to n8n. RankBench supplies selected public blog content to a separate ingestion workflow and is not a recipient of customer workspace data merely because its content is published.

When a workspace enables newsletters, its owner supplies and controls the SMTP account. OrbitPage submits recipient addresses and campaign content to that provider on the owner's instructions. Because OrbitPage does not select or contract with one shared newsletter provider for this feature, the customer's SMTP provider is not listed as an OrbitPage platform subprocessor; the customer must assess its terms, processing locations and safeguards.

A page owner can add external links and consent-gated content from services such as Instagram, Facebook, YouTube, Spotify, Apple Music, Deezer, SoundCloud, Mixcloud, Vimeo, Loom, TikTok, Giphy, Google Maps, Google Calendar, Calendly, Cal.com, Typeform and Google Forms. A Shop seller can connect Cal.com for booking lifecycle updates. A page owner can also choose iubenda, Cookiebot, CookieYes, OneTrust or an approved custom consent manager. These providers are selected by the page owner or visitor, not appointed by OrbitPage to process the platform's own data, so they are not OrbitPage subprocessors for that use.

When a visitor opens a link or consents to load an embed, the selected provider can independently receive network and browser information and use its own identifiers. The page owner must assess the provider, configure the correct consent category and explain the integration in their own privacy and cookie notices. Compatibility with a partner block does not mean that the provider sponsors, endorses or has a commercial partnership with OrbitPage.

For a connected Cal.com account, OrbitPage sends order-linked booking data such as buyer email, booking identifier, status and scheduled times on the seller's instructions. Official policy: Cal.com privacy.

External services can act as independent controllers or as processors appointed by a customer under a separate agreement. Their actual role depends on the enabled feature. A link does not load its destination until activated; an embedded resource or externally hosted media can disclose network and referrer information when loaded. The directory covers named integrations; custom URLs, images, video, scripts or consent managers introduce the additional providers selected by the page owner.

Social, messaging and source destinations: Meta: Instagram and Facebook; WhatsApp; TikTok; X; LinkedIn; Telegram; Discord; GitHub. GitHub also hosts the public source, issue and private vulnerability-reporting flows; information submitted there follows that service privacy terms.

Video, audio and animated media: Google/YouTube; Vimeo; Loom; Spotify; Apple Music; Deezer; SoundCloud; Mixcloud; Giphy.

Maps, calendars, forms and booking: Google Maps, Calendar and Forms; Calendly; Cal.com; Typeform. A seller-selected Cal.com connection can receive buyer contact data, intake answers, order-linked booking references, times, status and meeting URLs according to the seller instructions.

Consent management: iubenda; Cookiebot/Usercentrics; CookieYes; OneTrust; or the customer selected custom provider. A customer choosing SMTP, a registrar, external media or a custom service must supply that provider identity, notice and relevant safeguards in its own disclosures.

The installed FingerprintJS open-source library computes the returning-browser signal locally after consent; its optional monitoring is disabled. Its inclusion does not make FingerprintJS a recipient of that signal. React, Next.js and other software packages likewise are not automatically external recipients merely because their code is used. Vercel, Google, Cloudflare, OpenAI, PostHog, Resend and other contracted providers may rely on their own infrastructure suppliers; their linked subprocessor lists govern that onward chain. OrbitPage does not represent every library author or downstream infrastructure supplier as a commercial partner.

Providers may operate from the EEA, United States and other service locations. OrbitPage uses provider data-processing agreements, Standard Contractual Clauses, adequacy decisions or other lawful transfer mechanisms where required. Provider links above contain the latest location and transfer details.

OrbitPage may add or replace a provider as the service evolves. The directory is updated for material provider or purpose changes. For customer-controlled processing, the DPA requires active advance notice of intended additions or replacements and an opportunity to object on documented data-protection grounds. Organisations that need notice of subprocessor changes can request it at contact@orbitpage.com.