Last updated: September 29, 2026 — hosting and subprocessors
In accordance with Article 28 of the GDPR, RefCampaign publishes below the list of subprocessors involved in the processing of Users' personal data (Merchants, Affiliates, and visitors). Any substantial change — addition, replacement, or removal — is notified to the Merchant by email or via an in-Platform notification with at least 30 days' notice.
| Subprocessor | Purpose | Location | Safeguards |
|---|---|---|---|
| Hetzner Online GmbH | Platform and primary PostgreSQL database infrastructure (accounts, campaigns, conversions) | Helsinki, Finland (EU) | Data hosted in the EU — infrastructure administered by PAYET FABRICE with restricted access and encrypted backups |
| Vercel Inc. | Marketing website and documentation hosting (Next.js) | United States (global edge region) | Standard Contractual Clauses (SCC) — provider data processing terms |
| Stripe Payments Europe Ltd | Subscription payment processing and billing | Ireland (EU) with US back-office | Standard Contractual Clauses (SCC) — PCI-DSS Level 1 |
| Resend | Transactional email delivery (notifications, confirmations) | United States | Standard Contractual Clauses (SCC) — sender notifications.refcampaign.com |
| PostHog | Product analytics and usage tracking (with consent) | European Union (EU instance) | Data hosted in the EU — provider data processing terms |
| Contentsquare SAS | UX analytics, heatmaps and session replay on the marketing site (with analytics consent) | France / European Union | French company — Data Processing Addendum and GDPR safeguards |
| Inngest | Background task orchestration (workflows, crons) | United States | Standard Contractual Clauses (SCC) |
| Upstash | Redis cache and rate limiting | European Union / United States | Standard Contractual Clauses (SCC) — ephemeral data with TTL |
| Cloudflare Inc. | Tracking worker (click capture and affiliate redirects) | Global edge network | Standard Contractual Clauses (SCC) — provider data processing terms |
| Sentry | Application error monitoring (technical logs) | United States | Standard Contractual Clauses (SCC) — `sendDefaultPii: false` (IPs, cookies, and auth headers not transmitted) |
| PayPal | Automated affiliate commission payouts via PayPal Payouts API (only when activated by the Merchant) | Luxembourg (EU users) / United States | Standard Contractual Clauses (SCC) — Merchant OAuth2 credentials encrypted at rest |
| Plausible / Fabrice Payet | Audience measurement after analytics consent at analytics.fp-infra.dev | Self-hosted infrastructure administered by Fabrice Payet | Restricted access; event and session deletion after 25 months; encrypted backups for approximately 7 days |
| Meta | Optional advertising measurement after marketing consent | European Union / United States | Disabled before consent; applicable provider processing terms and transfer safeguards |
For any questions regarding subprocessors or to exercise a reasoned right of objection concerning a subprocessor change, please contact us at: contact@refcampaign.com.