Last updated: May 15th, 2026
In accordance with Article 28 of the GDPR, RefCampaign publishes below the list of subprocessors involved in the processing of Users' personal data (Merchants, Affiliates, and visitors). Any substantial change — addition, replacement, or removal — is notified to the Merchant by email or via an in-Platform notification with at least 30 days' notice.
| Subprocessor | Purpose | Location | Safeguards |
|---|---|---|---|
| Scaleway SAS | Primary PostgreSQL database (accounts, campaigns, conversions) | Paris, France | Data hosted in France (EU) — no transfer outside the EU. French legal jurisdiction. |
| Vercel Inc. | Hosting of the Platform and websites (Next.js) | United States (global edge region) | Standard Contractual Clauses (SCC) — signed Data Processing Addendum |
| Stripe Payments Europe Ltd | Subscription payment processing and billing | Ireland (EU) with US back-office | Standard Contractual Clauses (SCC) — PCI-DSS Level 1 |
| Resend | Transactional email delivery (notifications, confirmations) | United States | Standard Contractual Clauses (SCC) — sender notifications.refcampaign.com |
| PostHog | Product analytics and usage tracking (with consent) | European Union (EU instance) | Data hosted in the EU — signed Data Processing Addendum |
| Inngest | Background task orchestration (workflows, crons) | United States | Standard Contractual Clauses (SCC) |
| Upstash | Redis cache and rate limiting | European Union / United States | Standard Contractual Clauses (SCC) — ephemeral data with TTL |
| Cloudflare Inc. | Tracking worker (click capture and affiliate redirects) | Global edge network | Standard Contractual Clauses (SCC) — signed Data Processing Addendum |
| Sentry | Application error monitoring (technical logs) | United States | Standard Contractual Clauses (SCC) — `sendDefaultPii: false` (IPs, cookies, and auth headers not transmitted) |
| PayPal | Automated affiliate commission payouts via PayPal Payouts API (only when activated by the Merchant) | Luxembourg (EU users) / United States | Standard Contractual Clauses (SCC) — Merchant OAuth2 credentials encrypted at rest |
For any questions regarding subprocessors or to exercise a reasoned right of objection concerning a subprocessor change, please contact us at: contact@refcampaign.com.