Subprocessor list
Last reviewed: 16 October 2026
QR-Verse uses the subprocessors below to deliver the service. Each one is bound by a Data Processing Agreement (DPA) and processes personal data only on our written instructions. We update this page whenever a vendor is added, removed, or changes location, and we bump CONSENT_VERSION when a vendor change requires renewed cookie consent.
| Vendor | Category | Purpose | Data location | Added | DPA |
|---|---|---|---|---|---|
| Supabase | Infrastructure | Database, authentication, file storage | EU - Frankfurt (eu-central-1) | 2024-09-01 | DPA |
| Stripe | Payments | Payment processing, subscription billing | Ireland (EU) with US fallback under SCCs | 2024-09-01 | DPA |
| Resend | Communication | Transactional and marketing email delivery | EU + US under SCCs | 2024-11-15 | DPA |
| Cloudflare | Infrastructure | CDN, DDoS protection, edge caching | Global edge network | 2024-09-01 | DPA |
| Hetzner Online | Infrastructure | Application hosting, container infrastructure | EU - Germany only | 2024-09-01 | DPA |
| Sentry | Monitoring | Error tracking and performance monitoring, including diagnostic context for partner-recommendation impressions and clicks | EU region (de.sentry.io) | 2025-01-10 | DPA |
| Impact (pxf.io) | Affiliate (consent only) | Affiliate referral tracking - only loads if you opt into Affiliate cookies | US under SCCs | 2025-06-12 | DPA |
| NordVPN affiliate | Affiliate (consent only) | Partner referral attribution - only loads if you opt into Affiliate cookies | Panama with EU SCCs | 2025-08-20 | DPA |
| Analytics and sign-in | Google measurement (GA4; full measurements only after you accept analytics, before that only page-view pings in consent mode), the Google Ads click ID (only after you accept marketing) and Google Sign-In | EU and US | 2025-12-17 | DPA | |
| Hugging Face | AI generation | AI Art generation: your prompt, style parameters and the content of the QR code are processed by our private Space hosted on Hugging Face | United States | 2026-09-14 | DPA |
| Ahrefs | Analytics and sign-in | Visitor analytics (which pages are visited) - only loads if you accept analytics | Singapore (outside the EU); data stored in the United States according to Ahrefs' privacy policy | 2026-10-12 | DPA |
| Dynatrace | Analytics and sign-in | Performance measurement (how fast pages load) - only active if you accept analytics | Dynatrace environment of QR-Verse (region chosen by QR-Verse) | 2026-10-16 | DPA |
Questions about a subprocessor?
Email support@qr-verse.com