What this is: the third parties we rely on to run 99Websites. Each one processes data on our instructions under its own contract and security program. We update this list when it changes.
Current subprocessors
| Provider | Service | Data processed | Location |
|---|---|---|---|
| Cloudflare, Inc. | Website hosting & CDN, DNS, object storage (site files & client uploads), edge security, cookie-free Web Analytics (page views and performance, no cookies), and — later — inbound email routing | Site content, uploaded files, visitor IP addresses and request metadata | USA (global edge) |
| Railway Corp. | Application server and PostgreSQL database | Intake & project records, account data, messages, billing metadata, form leads | USA |
| Stripe, Inc. | Payment processing & subscription billing | Billing name, email, card details (held by Stripe), transaction and subscription data | USA |
| Resend (Plus Five Five, Inc.) | Transactional email delivery | Recipient email address, message content, delivery status | USA |
| Anthropic, PBC | AI assistance for producing websites | The business brief and materials you provide for your site (no payment data) | USA |
| GitHub, Inc. (Microsoft) | Source-code hosting and the scheduled database-backup job | Encrypted database backups, application code | USA |
| Google LLC | Google Analytics (aggregate measurement on 99websites.co, consent-gated); embedded Maps on a client site, when included | Page views, referrer, coarse location, device/browser — only after cookie consent; advertising features and Google Signals disabled | USA |
| Microsoft Corporation | Microsoft Clarity (session-replay & heatmap analytics on 99websites.co, consent-gated) | Page interactions (clicks, scrolls, mouse movement), page views, device/browser — only after cookie consent; text inputs masked by default | USA |
| Microsoft Corporation | Microsoft Advertising UET (ad-conversion measurement for our own Microsoft ads; Consent Mode — cookie-free until consent) | Page views, IP address, browser/device on every page; ad-click identifiers and cookies only after marketing-cookie consent | USA |
Changes to this list
We will update this page before a new subprocessor starts processing personal information for a material new purpose. Clients with an active subscription can ask to be notified of changes by emailing privacy@99websites.co with "Subprocessor updates" in the subject.
Data processing terms
Where you need a data processing agreement covering our handling of personal information on your behalf, see our Data Processing Addendum.
Questions
Maintained for transparency and to support our Privacy Policy. Not legal advice.