About the data

Where it comes from

Each vendor publishes its subprocessor list on a public page. Once a day we fetch that page, read the list (name, purpose, location as the vendor gives them) and compare it with the last list we saw. A difference is recorded as a change with the time we observed it. We keep the extracted list and a SHA-256 hash of the page, not a copy of the page.

A vendor is listed only after a person has opened its page and confirmed it is the vendor's subprocessor list.

What a change date means

The date is when we first saw the change, not when the vendor made it or notified its customers. Your DPA and the vendor's notices are authoritative.

When a page cannot be read

If a page is unreachable, returns an error, or suddenly lists no entries or less than half of the previous ones, we record nothing and fix the reader. Such a crawl never shows up as removed subprocessors.

Our crawler

User agent: ZEKG-SubprocessorWatch/0.1 (+https://subprocessors.zekg.com/about#crawler). It honours robots.txt, fetches one page at a time with at least two seconds between requests, and visits each vendor page once a day. Vendors who want a page corrected or removed can write to [email protected].

Privacy

The waitlist stores the email address you enter, the vendors you selected, your consent and the time. We do not store your IP address or browser details with it. We use it only to tell you when email alerts launch, keep it for 12 months, and delete it earlier on request to [email protected]. The form is protected by Cloudflare Turnstile, which loads from Cloudflare only once you start filling in the form and runs under Cloudflare's own privacy policy. The site runs no analytics.