Version 2026-08-16
Subprocessor List
Effective 16 August 2026
This list identifies principal processors used for Customer content and related service data. OAuth providers and Google Sheets are initiated by the user and may act as independent controllers or processors depending on the interaction.
| Provider | Service and purpose | Processing location |
|---|---|---|
| Cloudflare, Inc. | Website/application delivery, security, Workers, R2 object storage and infrastructure | Global edge network; application R2 bucket uses the Eastern Europe (EEUR) location hint; encrypted database-backup R2 buckets are configured with the EU jurisdiction; support and subprocessors may process limited data in other countries, including the United States |
| Supabase, Inc. | Database and authentication | AWS eu-central-1 (Frankfurt, Germany) for primary storage and processing; support and subprocessors may process limited data in other countries |
| Stripe Payments Europe, Limited and Stripe affiliates | Checkout, subscriptions, invoices, fraud prevention and billing portal | Ireland, the EEA, the United Kingdom, the United States and other Stripe affiliate/subprocessor locations |
| Brevo / Sendinblue SAS | Transactional email delivery | France and other Brevo subprocessor locations |
| Google Workspace | Business, privacy-request and support email hosting, including message content, attachments and email metadata | Google data-centre, support and subprocessor locations described in the applicable Workspace terms and current subprocessor register |
| Mapbox, Inc. | Interactive map styles, tiles and related delivery telemetry | United States and global content-delivery locations |
Provider location information includes primary service locations and may also include remote support, security and subprocessor access. See Cloudflare’s explanation of the difference between an R2 location hint and jurisdiction restriction, and the current provider registers for Google Workspace and Mapbox.
Change notifications
We update this public register when a principal provider used to deliver Flowmap City changes. Questions about a provider or a change can be sent to privacy@flowmap.city. Any contractual notice or objection rights agreed with a Customer are governed by that Customer’s agreement with GeoVisually.