The services that help run this site.
A formal list of third-party subprocessors used to operate eloi.works. Kept here at the URL /sub-processors so it's easy for enterprise procurement + legal teams to review before signing a DPA. Last updated August 2026.
What's a subprocessor?
A subprocessor is any third-party service that processes personal data on my behalf — hosting the site, storing your chat messages, sending you email, etc. Under GDPR Article 28 and similar regimes, I'm required to disclose these publicly so you (or your legal team) can review who touches your data before agreeing to work together.
Everything on this list is used to run eloi.works itself. If you hire me for a project, that project may use additional services chosen for your specific needs — those are disclosed separately in your engagement contract.
Current subprocessors
| Subprocessor | Purpose | Region | Policy / DPA |
|---|---|---|---|
Vercel Infrastructure | Web hosting, edge network, function execution, analytics + speed insights | USA + regional edges (global CDN) | Read policy → |
Supabase Infrastructure | Postgres database (chat conversations, owner state) | USA (default) — regional selection available | Read policy → |
Cloudflare Infrastructure | DNS management, SSL/TLS termination, CDN, DDoS protection | Global (network of 300+ cities) | Read policy → |
Resend Communications | Transactional email delivery (chat replies) | USA | Read policy → |
Cal.com Communications | Discovery-call booking calendar (only involved if you book a call) | USA | Read policy → |
Clerk Authentication | Owner authentication for the private /inbox area (does not touch visitor data) | USA | Read policy → |
GitHub Operations | Source code hosting (visitor data is never stored in the repo) | USA | Read policy → |
What I don't use
- No third-party ad networks or ad-tracking pixels
- No cross-site tracking cookies
- No marketing pixels (Facebook, TikTok, LinkedIn Insight, etc.)
- No session-recording tools (Hotjar, FullStory, etc.)
- No third-party chat widgets — the chat is built in-house
- No customer data platform, no marketing automation, no ad retargeting
Data Processing Agreement (DPA)
If you're an enterprise client or an EU visitor and need a signed Data Processing Agreement, I'll countersign a standard one on request. Message me in the chat with the subject “DPA request” and include the entity + DPO contact — I'll turn it around within 5 business days.
Each subprocessor above has its own DPA with me (or standard clauses in their terms of service). Copies available on request for enterprise review.
Changes to this list
I'll update this page whenever a subprocessor is added or removed, and bump the “last updated” date. Enterprise clients on an active DPA get 30 days' notice by email before a new subprocessor starts processing their data — with a right to object.
Related
- Privacy policy — what data I collect, how long I keep it, your rights
- Terms — how engagements work, IP transfer, cancellation
Contact
Questions about this list, or a specific subprocessor concern? Ping me in the chat bubble at the bottom-right. For DPA-specific queries, prefix your message with “DPA:” so I route it correctly.
This list reflects the services in production today. It's an authoritative source for GDPR Article 28 disclosure, but not a substitute for reviewing each subprocessor's own privacy policy + DPA terms for your specific risk assessment.