Subprocessors
Last updated 11 October 2026
We use these providers to run Page Lemon. Page Lemon is operated by Aporia Research Ltd, London N22 8NL, the data controller that engages them. Each is bound by a data processing agreement (DPA) that limits how it may use personal data. We will update this page at least 14 days before adding a new subprocessor that handles personal data.
- 5 providers plus Google if you sign in with it
- London, UK servers (DigitalOcean)
- EU backups (Cloudflare R2)
- 14 days notice before a new one
| Provider | Purpose | Data involved | Location | DPA |
|---|---|---|---|---|
| Cloudflare, Inc. | CDN, TLS, DNS, DDoS protection in front of all our domains; backup storage (R2, EU jurisdiction) | Visitor and user IP addresses, request data, site files in transit and cache; database backups | Global edge network; R2 backups in the EU | cloudflare.com/cloudflare-customer-dpa |
| DigitalOcean, LLC | Servers (Droplets) that store and serve sites and run our API | All service data: accounts, site files, deploy history, logs | London, UK (lon1) | digitalocean.com/legal/data-processing-agreement |
| Clerk, Inc. | Sign-in and account management (email or Google) | Email, name, profile image, sign-in sessions, device/IP data for fraud protection | USA (Google Cloud) | clerk.com/legal/dpa |
| Stripe | Payments and subscriptions for paid plans | Name, email, billing address, payment card (held by Stripe only), subscription status | USA and other Stripe locations | stripe.com/legal/dpa |
| Resend, Inc. | Sending service emails (sign-in links, invites, receipts, notices) | Recipient email address, email content, delivery metadata | USA (account data stored in the US regardless of sending region) | resend.com/legal/dpa |
| Google LLC Only if you choose "Sign in with Google" | Identity provider for Google sign-in | Your Google account email, name and profile image, shared with Clerk at your request | USA / global | Google acts as an independent controller for your Google account; see policies.google.com/privacy |
Notes
- Stripe acts as an independent controller for some payment data (for example fraud prevention and financial regulation); see stripe.com/privacy.
- Provider subprocessor lists: Clerk, Resend, Cloudflare, DigitalOcean, Stripe.
Changes: any new subprocessor that handles personal data appears here at least 14 days before we start using it. Questions? Email support@pagelemon.com. How we use personal data is in our Privacy Policy; how we protect it is on Security.