Subprocessors
Last updated on 15 October 2026
To run Cookiemark we use a small number of other companies. This page lists each one, what it does for us, which data it handles and where. Our data processing agreement explains how we choose them and how we tell you about changes.
Processing your visitors' data
These companies handle data of the visitors to your websites, which we process on your behalf.
| Company | What it does | Data | Where |
|---|---|---|---|
| Supabase | Database and sign-in for the dashboard. | Consent log, scan reports, and every setting and list in your account. | Ireland (EU), AWS region eu-west-1 |
| Bunny.net (BunnyWay) | Hosting of the Cookiemark application, which receives your visitors' choices, and the content delivery network that serves the script. Bunny Fonts serves banner fonts you choose. | Consent records in transit, and the IP address and browser details of each visitor who loads the script, sends a choice or loads a font. | Slovenia (EU); the application runs in Amsterdam |
| Hetzner | Servers that run the scanner. | The public pages of your site as a visitor sees them, the cookies found, and a screenshot of the start page. | Germany and Finland (EU) |
| xCloud | Management of the scanner servers at Hetzner. | The same as Hetzner, as far as it is on those servers. | Servers in Germany (EU) |
Processing your account data
These companies handle data of you and your team, for which we are the controller. They never receive your visitors' consent records.
| Company | What it does | Data | Where |
|---|---|---|---|
| Stripe | Taking payments for paid plans. | Your billing name, address, email address, VAT number and payment details. | EU entity, with processing in the US |
| Moneybird | Invoicing and bookkeeping. | Your billing name, address, email address and VAT number, and your invoices. | The Netherlands (EU) |
| Elastic Email | Sending sign-in links, invitations and notifications. | The email address and name of the recipient, and the content of the mail. | Canada, which has an adequacy decision of the EU |
| Cloudflare | DNS for our domains, and the Turnstile check on our sign-in and free scan forms. | For Turnstile: the IP address and browser details of the person filling in the form. | Global network |
Cloudflare is not in the path of your visitors' data. It answers DNS questions for our domains, but requests from your visitors go straight to Bunny.net, not through Cloudflare.
Country lookup
To apply region rules and to note a visitor's country in the consent log, we look up the country of the visitor's IP address in a database inside our own application. No address is sent anywhere for this. The database is IP Geolocation by DB-IP, licensed under Creative Commons Attribution 4.0.
Changes to this list
We add the date of every change to the top of this page. Before we add or replace a company that handles your visitors' data, we tell you by email. We do that at least 30 days in advance, so you can object.