Sub-processors
The companies that process personal data for Muzzle, what each one receives, and where.
Last updated 29 October 2026
Sub-processors
| Company | What for | Data | Where |
|---|---|---|---|
| Cloudflare, Inc. | Website and API hosting, database, receiving email | Everything our API stores (see Security), short-lived request logs, mail to contact addresses and support in transit | Requests are served from Cloudflare's global network; the database runs in Western Europe. USA company. |
| Stripe, Inc. and its affiliates | Checkout, subscriptions, tax; merchant of record | Email address, billing address, payment details, subscription | USA and EU |
| Resend, Inc. | Sending email: keys, sign-in and confirmation links, download links, forwarded mail | Recipient address and message content | Sent from the EU (Ireland). USA company. |
| Hetzner Online GmbH | Server for our Umami analytics | Page views and events with page, referrer, browser, device type, language and country; no cookies, no stored IP addresses | Germany |
Where a provider processes data outside the EU/EEA, it does so under safeguards such as the EU standard contractual clauses.
Others that receive data
These are not our sub-processors; each uses the data under its own terms.
| Only for visitors who arrive from a Muzzle ad on Reddit: the ad's click id and the time of a download request. With cookie consent, the Reddit Pixel. See Privacy. | |
| Google Fonts | The website loads its typefaces from Google, which receives the visitor's IP address and browser. |
| OSV, npm, PyPI, crates.io | The app asks them directly about packages an agent installs: the package name and a Muzzle user agent. Nothing goes through us. Package checks can be turned off. |
Changes
We update this page and its date before a new sub-processor starts processing personal data. Customers under our DPA get 30 days' notice and can object.