Subprocessors
The companies that host or carry the visitor data Candler processes for its customers. Under the Data Processing Addendum, we email account owners at least 30 days before adding or replacing one.
The current list.
| Company | What they do for Candler | Data they handle | Location |
|---|---|---|---|
| Hetzner Online GmbH | The servers, storage and backups the Service runs on | All Customer Data | Nuremberg, Germany |
| Cloudflare, Inc. | DNS, the network that carries traffic between browsers and our servers and protects it from attacks, and storage for session recordings and encrypted offsite copies of the nightly database backup | Visit data in transit, which Cloudflare's network doesn't keep. Session recordings, encrypted with a key Cloudflare doesn't have, kept as long as your plan and settings say. Backups of all Customer Data, encrypted the same way, kept 14 days. | Global network. Recordings and backups in the EU. Company in the United States. |
Providers that never see visitor data.
These help us run Candler as a business. They handle information about our customers and their teams, as the Privacy Policy explains, but never your visitors' data.
| Company | What they do | Location |
|---|---|---|
| Stripe, Inc. | Subscriptions, payments, invoices and tax | United States |
| Shopify Inc. | Bills stores that pay through the Candler app for Shopify. Candler reads their plan from Shopify and sends Shopify nothing about their visitors. | Canada |
| Resend, Inc. | Account emails: signup links, password resets and team invitations. Summary emails your team turns on, which carry totals for a website (sessions, orders, revenue, top pages with order and checkout numbers removed, product names and traffic sources) and nothing about any one visitor. Alert emails your team turns on, which carry the same kind of totals for a stretch of hours (visits, carts, checkouts and orders against a normal week) and, for a new checkout error, the error's message and the pages it was on, with anything that could point at one person, order or checkout taken out. | United States |
Changes to this list.
October 18, 2026: Resend also sends the alert emails your team turns on. Like summaries, they carry a website's totals and masked error messages, not visitor data, so Resend stays off the subprocessor list.
October 13, 2026: Cloudflare also stores session recordings, in the EU, encrypted on our server before they're sent, with a key Cloudflare doesn't have. Cloudflare was already a subprocessor and already held them in encrypted backups.
October 8, 2026: Shopify added, for stores that pay through the Candler app for Shopify. It bills them and never sees visitor data, so it isn't a subprocessor.
October 6, 2026: Resend also sends the summary emails your team turns on. They carry a website's totals, not visitor data, so Resend stays off the subprocessor list.
September 30, 2026: Cloudflare also stores encrypted offsite copies of the database backups, in the EU. Resend added for account emails.
September 29, 2026: first published.
Questions about a subprocessor, or want to object to a new one? Email hello@candleranalytics.com.