SaaS Tracker legal document
Subprocessor and Third-Party Service Provider List
Effective dateSeptember 5, 2026
This list identifies providers SaaS Tracker LLC currently uses for saastracker.co, the SaaS Tracker platform, and related services (the “Service”). “Customer Content” means any documents, data, files, or other content uploaded, submitted, retrieved, or created by customers or their authorized users through the Service. A provider's legal role may vary by service, configuration, location, and applicable law. Some providers act as SaaS Tracker's processor or subprocessor; others act as independent controllers, infrastructure providers, or, for Sold through Link, LLC, as merchant of record for Managed Payments transactions. This list should be read with the Privacy Policy, Security and Data-Handling Overview, the provider notices and terms presented at checkout, and any applicable data processing addendum.
Processor/subprocessor for ChatGPT Sites and configured business/API services
ChatGPT Sites hosting, maintenance, deployment and hosting-control-plane services; AI-assisted analysis of retrieved document text and document changes, and related model operations.
Hosted account and workspace data, Customer Content and document snapshots, relevant retrieved document text or document differences, structured relationship metadata, prompts, outputs, citation and extraction metadata, user/workspace identifiers, and request-level technical metadata.
United States, EEA, United Kingdom, and other approved processing locations; applicable DPA and transfer safeguards.
Processor/subprocessor and infrastructure provider
Application execution, content delivery, network security, D1 database, private R2 object storage, and related infrastructure supporting the hosted Service.
Account identifiers, Customer Content, document snapshots, workspace and billing-entitlement records, and technical/security logs.
Global infrastructure, including the United States; data-location choices and transfer safeguards as applicable.
Processor/subprocessor
Hosted AuthKit authentication, email and social sign-in, organization identity, invitations, sessions, user identity and access management, fraud and bot prevention, and associated security and operational telemetry through WorkOS and its approved providers.
Account identifiers, user profile and organization data, authentication and login metadata, session and invitation data, IP/network and browser/device information, security signals, challenge results, and diagnostic or operational telemetry. Customer documents and unrelated page content are not approved for this flow.
United States and other approved processing locations; contractual transfer safeguards as applicable.
Processor/subprocessor
Transactional and service email delivery, including invitations, alerts, digests, assignment notices, support, and operational communications.
Recipient name and email, message content and links, delivery status, and email metadata.
Account data is primarily stored in the United States; sending region and downstream providers may vary; contractual transfer safeguards as applicable.
Merchant of record and/or independent controller; processor in limited contexts depending on the service
Managed Payments checkout and merchant-of-record services; payment processing; subscriptions; receipts and invoices; order management; indirect-tax calculation, collection, filing, and remittance; fraud prevention; disputes; refunds; transaction-level support; and regulatory compliance.
Billing contact, payment instrument and billing address, Link-account information, order and subscription data, invoices and receipts, refund and dispute records, indirect-tax information, device and fraud signals, and transaction-support communications. SaaS Tracker receives limited order, subscription, and transaction-status records.
Global, including the United States and EEA; Stripe and Link privacy, service, and transfer terms apply.
Processor/subprocessor and infrastructure provider
Private malware-scanning service infrastructure, compute, network security, and associated operational monitoring.
Retrieved document or snapshot bytes submitted for scanning; scan identifiers and verdicts; file metadata; source/workspace references needed for traceability; and technical/security logs. Malware-scanning infrastructure is not used for ordinary AI analysis.
Oracle Cloud Infrastructure region in the United States; Oracle affiliates and subprocessors may support the service globally under applicable contractual transfer safeguards.
Processor and/or independent controller for historical Analytics data, depending on the operative terms and configuration
Retention and administration of historical Google Analytics 4 data collected before GA4 was removed. No new SaaS Tracker website analytics or advertising collection is active.
Previously collected analytics identifiers; IP address or coarse location; limited device, browser, network and interaction data; normalized public pathname; canonical public URL; fixed public title; and blank referrer. No new data is approved for this flow after removal.
Global; Google contractual and transfer terms apply.
Infrastructure service provider; processor or independent controller depending on the activity
Domain registration and Domain Name System services for saastracker.co.
Domain registrant and administrative data; DNS request and technical metadata. Customer Content is not provided to GoDaddy in ordinary operation.
Global infrastructure, including the United States.
Provider safeguards and additional subprocessors Each provider may use its own affiliates and subprocessors under its applicable terms. Customers should review the provider's current privacy, data processing, security, and subprocessor materials. SaaS Tracker seeks contractual commitments appropriate to the provider's role and uses recognized transfer safeguards where required. Provider certifications, locations, services, terms, and downstream subprocessors may change. This list is provided for transparency and customer diligence and is not a certification, warranty, service-level commitment, or standalone data processing agreement. SaaS Tracker does not guarantee and assumes no liability for any provider’s compliance, security practices, or data handling.
Customer notice and objections SaaS Tracker may update this list as the Service, providers, configurations, or applicable law changes. We will post an updated effective date and provide advance notice of a new subprocessor where required by an applicable data processing addendum or other written agreement. A customer may submit a reasonable, documented data-protection objection within the period stated in that addendum or agreement. If the parties cannot resolve the objection, the sole remedy will be discontinuation of the affected feature or Service, unless the applicable agreement expressly states otherwise.
Questions Questions about this list or a provider's role may be sent to hello@saastracker.co. SaaS Tracker LLC, 30 N. Gould St., Ste R, Sheridan, WY 82801, United States