Legal
Sub-processors
Last updated: May 3, 2026
This page lists every entity Pullminder engages to process customer personal data on our behalf, the purpose of each engagement, the categories of data they receive, and the legal basis used to transfer data outside the EEA where applicable. We update this page at least 30 days before adding or replacing a sub-processor.
To receive email notifications of changes, subscribe at privacy@pullminder.com with the subject "Sub-processor notifications".
| Sub-processor | Purpose | Data | Location | Transfer mechanism |
|---|---|---|---|---|
| GitHub, Inc. | Source of pull-request events; webhook delivery; OAuth identity. | GitHub login, repository metadata, PR diffs (transient). | United States | EU SCCs; data subject acceptance via GitHub TOS. |
| Anthropic PBC | AI reviewer brief generation (when the Controller has opted in). | PR title, file paths, up to ~3KB of diff hunks per request. | United States | EU SCCs in the Anthropic DPA; zero-retention API endpoint. |
| Slack Technologies, LLC | Optional alert delivery to the Controller-configured workspace. | Alert message body, repository names, PR titles, risk scores. | United States | EU SCCs via Salesforce DPA. |
| Google LLC (Tag Manager, Analytics, Fonts) | Aggregate website analytics (after explicit consent) and webfont delivery. | Hashed visitor identifier, IP address, page URL, referrer. | United States | EU-US Data Privacy Framework + EU SCCs. |
| Viva Wallet (Viva Payment Services SA) | Card and SEPA payment processing for paid plans. | Billing email, billing address, VAT number, payment instrument tokens. | Greece, European Union | Intra-EU; no cross-border transfer. |
| Hetzner Online GmbH | Infrastructure-as-a-service: virtual machines, block storage, load balancers. | All Customer Personal Data at rest and in transit. | Germany and Finland, European Union | Intra-EU; no cross-border transfer. |
| Coolify (Coolify, Inc.) | Self-hosted control plane running on Hetzner; deployment orchestration. | Service configuration; no Customer Personal Data persisted by Coolify itself. | Self-hosted on EU infrastructure. | Intra-EU. |
| Cloudflare, Inc. | CDN and DDoS protection in front of pullminder.com and docs.pullminder.com. | IP address, user-agent, request URL. | United States (with EU edge processing). | EU SCCs via Cloudflare DPA; EU customers can opt for the EU regional service. |
Notes
- Anthropic, Slack, Google, and Cloudflare process data only when the Controller has enabled the corresponding feature or visited a marketing page. The AI reviewer brief is opt-in per organisation; analytics tags load only after explicit cookie consent.
- Where a sub-processor is in the United States, transfers rely on the 2023 EU-US Data Privacy Framework where the entity is certified, supplemented by Standard Contractual Clauses (Module 3) and the Processor's published technical safeguards.
- Anthropic processing for the AI reviewer brief uses a zero-retention API endpoint: prompts and responses are not retained beyond the request lifecycle.
Questions or objections
Email privacy@pullminder.com. Reasonable objections to a new sub-processor are handled per Section 5 of the Data Processing Agreement.