Open source & self-hostable
Subprocessors
Last updated: August 18, 2026
Aglyn LLC uses the third-party subprocessors below to provide the Services. This list supports the Data Processing Addendum and Privacy Policy. Before a new subprocessor begins processing customer personal data, we will add it to the change log below at least 30 days in advance. Customers may object on reasonable data-protection grounds within that period by writing to support@aglyn.com; Section 7.2 of the DPA describes what happens next. Urgent changes needed to protect the security or availability of the Services may be made on shorter notice and are published here as soon as practicable.
Core infrastructure & platform subprocessors
| Subprocessor | Provider entity | Purpose | Data processed | Location |
|---|---|---|---|---|
| Google Firebase Authentication | Google LLC | User authentication, sign-in, session, and auth emails (verification, password reset) | Account identifiers, email, auth tokens, OAuth identities | United States (Google operates a global service) |
| Google Cloud Firestore | Google LLC | Primary application database (multi-tenant) | Account, org, content, commerce, CRM, and configuration data | United States (nam5 US multi-region) |
| Google Cloud / Firebase Storage | Google LLC | Media and asset storage | Uploaded images, video, files | United States (US multi-region) |
| Vercel Inc. | Vercel Inc. | Application hosting, edge/CDN, custom-domain SSL and provisioning | Request/usage data, IP, content served | United States (primary compute), with a global edge network for cached content |
| Stripe, Inc. | Stripe, Inc. | Subscription billing and, via Stripe Connect, facilitation of Customer merchant sales | Billing contact, subscription/transaction metadata, payment data (processed by Stripe) | United States |
| Resend | Plus Five Five, Inc. (d/b/a Resend) | Transactional and app-generated email delivery (invites, receipts, usage summaries, campaigns) | Recipient email, message content/metadata | United States |
| Google reCAPTCHA | Google LLC | Bot protection / anti-abuse (via Firebase App Check) | IP, device/browser signals, interaction data | United States (Google operates a global service) |
| Google Analytics | Google LLC | Product and site analytics for aglyn.com, the console, and the documentation site (a single GA4 property), configured for measurement only — Google Signals off, ads personalization disabled in every region, no Google Ads account linked, no user-provided data collection, email redaction on, 14-month retention | IP address, device/browser signals, page and event interaction data, a cookie-based pseudonymous identifier | United States (Google operates a global service) |
| Google Fonts | Google LLC | Serving web-font files to visitors of published sites whose theme selects a Google font, and to the console editor surfaces | Visitor IP address and browser user-agent, sent by the visitor's browser when it requests the font file | United States (Google operates a global service) |
| Google Cloud Logging | Google LLC | Collecting uncaught browser errors from the console and from published sites, for diagnosis and reliability | Error message and stack trace, source file, line number, and the origin and path of the page (query strings are removed before transmission) | United States (Google operates a global service) |
| Anthropic | Anthropic, PBC | AI-assisted features in the console and the site editor, including the Aglyn Assist helper and editor assistance (rewriting element copy, drafting blog bodies, generating a section layout) | The text the user submits to the feature — their question or instruction, and the content of the element, post, or page being worked on — together with the generated response. No account identifiers, email addresses, or authentication tokens are transmitted. | United States |
Related services
- Google Workspace (Google LLC) — inbound/human email for @aglyn.com (e.g., support, contact). May process email you send to us.
- Google Cloud DNS (Google LLC) — DNS management for aglyn.com domains.
Change log
- August 18, 2026 — Added Google Analytics (analytics for Aglyn's own properties), Google Fonts (web fonts on published sites), and Google Cloud Logging (browser error reports); added Anthropic for AI-assisted features, including the Aglyn Assist helper. Aligned this list with the DPA, the Privacy Policy, and the trust page. Stated the 30-day advance-notice period for new subprocessors and the objection route, matching DPA Section 7.2.
- August 13, 2026 — Verified provider entities and processing locations; corrected the Resend entity name; reconciled this list with the trust page.
- August 5, 2026 — Initial publication.
Notes
- Payment card data is collected and processed directly by Stripe under its own terms; Aglyn does not store full card numbers.
- For commerce features, sales are processed through Aglyn's own Stripe account and the Customer merchant's share is transferred to a connected Stripe Connect account held in the merchant's name (Terms of Service Section 10.2). Stripe acts as an independent controller/processor for that payment processing under its own agreements with Aglyn and with the merchant.
© 2026 Aglyn LLC. All rights reserved.