Legal
Sub-processors
Effective October 19, 2026
Services we use
Your data is stored in the region you chose when you signed up. We say stored in the EU for the European Union region, and no more: the code runs close to the visitor, and logs and billing are not limited to it. The regions page has the full list. Subscribers' emails are sent by Amazon SES in the region of the creator's account.
| Service | What it does | Data it can touch | United States | European Union |
|---|---|---|---|---|
| Cloudflare | Runs the app (Workers), stores the database (D1) and files (R2), serves and caches public images, keeps the Workers logs, runs the support assistant on Workers AI through AI Gateway with its logging turned off, serves newsletters' websites on creators' own domains with their certificates (Cloudflare for SaaS), and holds the DNS records of shared sending addresses. | Everything in an account, subscriber lists, issues and readers' comments included. In the logs: request details, IP addresses, and a line per sign-in with the email address and browser. The messages typed to the support assistant, with the conversation before them, while it writes an answer. The website domains creators add. | D1 and R2 where Cloudflare chooses. The code runs in the data center closest to the visitor. Logs aren't limited to a region. Workers AI runs on Cloudflare's global network. | D1 and R2 with the EU jurisdiction, which keeps their data in the EU. The code runs in the data center closest to the visitor, and logs aren't limited to the EU. Workers AI runs on Cloudflare's global network, so the messages typed to the support assistant may be processed outside the EU. |
| Amazon SES (Amazon Web Services) | Sends every email: newsletters to subscribers, and FlockStack's own sign-in codes, alerts, export links and the support conversations people choose to email to support. Reports deliveries, bounces and complaints back through Amazon SNS. | Recipients' email addresses, sender details, the content of each email and delivery events. | Amazon SES in us-east-2 (Ohio). A subscriber's email is sent by SES in the region of the creator's account. | Amazon SES in eu-west-1 (Ireland). A subscriber's email is sent by SES in the region of the creator's account. |
| Upstash QStash | Background jobs: sending batches, scheduled sends, automations, exports and account deletion. | IDs and counts, not email content. | QStash in its US region. | QStash in its EU region. |
| Polar | Bills FlockStack plans: checkout, subscriptions, invoices and the customer portal. | The account holder's email address, billing and payment details, and the plan. Our database keeps their customer and subscription IDs and the plan's status. | Polar's own locations. One Polar account serves both regions. | Polar's own locations. One Polar account serves both regions. |
| Stripe | Takes payments from readers for what a creator sells, through Stripe Connect, when the creator turns selling on. Can bill FlockStack plans instead of Polar on a server set up that way. | A buyer's name, email address and payment details, paid to the creator's own Stripe account. FlockStack gets the order: email, name, product and amount. FlockStack takes no fee on it. | Stripe's own locations. One Stripe account serves both regions. | Stripe's own locations. One Stripe account serves both regions. |
| PostHog | FlockStack's own product analytics, to see how people use FlockStack's pages. Only on those pages: the home page, the docs, the legal pages, sign-in and the dashboard. Never on a newsletter's public pages or the pages readers use. It uses its own cookies or local storage. One PostHog project serves both flockstack.io and eu.flockstack.io. | Page views, clicks and actions, device and browser, approximate location, and for signed-in people the user ID, email address and plan. Session recording is off. Never a newsletter's content or a subscriber's data. | PostHog US Cloud. It runs unless the visitor declines in Cookie settings; visitors in the EU, the EEA, the UK and Switzerland are asked first. A Global Privacy Control or Do Not Track signal turns it off. | The same PostHog project on PostHog US Cloud, so events from eu.flockstack.io are processed in the United States, not in the EU. It runs only after the visitor accepts. A Global Privacy Control or Do Not Track signal turns it off. |
Optional services
These are off unless the person running the server sets them up.
| Service | What it does | Data it can touch | United States | European Union |
|---|---|---|---|---|
| Google (sign-in) | An optional way to sign in: Sign in with Google. | Google receives the sign-in request and the person's choice to sign in. FlockStack gets the email address Google has verified. | Google's own locations. | Google's own locations. |
| Apple (sign-in) | An optional way to sign in: Sign in with Apple. | Apple receives the sign-in request and the person's choice to sign in. FlockStack gets an Apple user ID, the email address Apple has verified, which can be a private relay address that Apple forwards to the person's inbox, and, the first time only, the name if the person chooses to share it. | Apple's own locations. | Apple's own locations. |
| Google Postmaster Tools | A FlockStack admin can connect it to read Gmail's spam rates for the sending domain. | Statistics only. Nothing about subscribers is sent to Google. | Google's own locations. | Google's own locations. |
| Telegram | Alerts to the FlockStack team when something needs a person: an account block, a failing job or webhook. | Account IDs and the alert's text. For a spam-trap block, the address that bounced. Never an email's content. | Telegram's own locations. One chat serves both regions. | Telegram's own locations. One chat serves both regions. |
| Upstash Redis | Shared rate-limit counters. Without it they are counted in the region's database. | Counters keyed by IP address or email inbox and the form they limit. | The Redis database's region. | The Redis database's region. |
| Vercel | A small DNS helper that publishes the records for shared sending addresses, like a newsletter's name on flockstack.io. | A newsletter's address name and its DNS records. No subscriber data. | Vercel's own locations. | Vercel's own locations. |
Of these, FlockStack Cloud uses Google sign-in. Sign in with Apple is optional: the button shows only once it is set up. It does not use Google Postmaster Tools, Telegram alerts, Upstash Redis or the DNS helper.
Who isn't on this list
Readers' own mailbox providers receive the emails you send, and are not our sub-processors. A creator's own Stripe account, domain name provider and website are theirs.
Changes
When we add a sub-processor, we update this page and email account owners at least 30 days before it starts handling data.
Data processing
For the personal data of a creator's subscribers, the creator is the controller and KMF Ventures LLC, a Wyoming limited liability company is the processor. We process it only to run the newsletter on the creator's instructions, which are what they do in the dashboard, the API and MCP. We use the services above to do that, keep the data in the region the creator chose as described on this page, help creators answer their subscribers' requests (the export, deleting contacts and deleting the account are in the product), and delete the data when the account is deleted, as the privacy policy says.
We offer a data processing agreement (DPA) on request. Write to hello@flockstack.io. The terms and the privacy policy cover the rest.