Subprocessors
The third-party vendors WebForger relies on to operate the service. Last updated 22 October 2026 (v1.1). Forms part of the Privacy Policy and the Data Processing Addendum.
Quick read: WebForger is built on a small, named set of vendors. Cloudflare hosts your site, your store data and our infrastructure; a few additional services handle AI generation, payments, email and analytics. We list every vendor below with what they do, what data they touch and where to read their privacy commitments. We give 14 days' notice in the dashboard before adding a new subprocessor that materially affects how we process your data.
1. Core infrastructure
The platform lives entirely on Cloudflare. There is no separate hosting region, no separate CDN, and no separate DDoS provider. Removing or degrading Cloudflare would take WebForger offline.
| Vendor | Purpose | Data region | Privacy |
|---|---|---|---|
| Cloudflare, Inc. United States |
Hosting (Workers), object storage (R2), relational database (D1), key-value (KV), CDN, DNS, WAF, DDoS protection, image delivery, queues, first-party site analytics, inbound email routing and delivery of order emails. Hosts both the marketing site and every customer site. D1 and R2 store merchants' store records, including buyers' names, email addresses, phone numbers, billing and shipping addresses, order history, account and programme balances, and product reviews. | Global edge; primary R2 storage and D1 databases currently in Cloudflare's Oceania region. Visitor IPs processed at edge. | Policy |
2. AI generation
Wizard and editor prompts you submit are sent to third-party AI providers to draft text or imagery. Where spam filtering is enabled for a site, the content of lead-form submissions is also sent to an AI language model provider to screen out spam. The output is yours; the provider acts as a processor under our commercial terms and does not own or train on the result. Specific vendor names are confirmed to account holders on written request, under confidentiality, under our Data Processing Addendum.
| Category | Purpose |
|---|---|
| AI language model provider | Site drafting, copywriting, blog generation and editor assistance; spam screening of lead-form submissions where enabled. |
| AI image generation provider | Hero images, blog imagery and brand assets. |
3. Payments
WebForger does not store full card numbers. Card details are entered directly into the provider's hosted form or payment element. For your WebForger plan we receive an internal reference, the last four digits, brand, expiry, and the billing country. For payments in your store, see the Stripe description below.
| Vendor | Purpose | Data region | Privacy |
|---|---|---|---|
| Stripe, Inc. United States / Ireland |
WebForger plans: card processing, subscription billing, invoicing, fraud screening. Merchant stores: buyers' payments are made on the merchant's own Stripe account (as direct charges where the account is connected through our platform) and settle to the merchant's bank. Stripe collects the merchant's identity and payout details directly. WebForger sends Stripe the order amount and currency, order references, the shipping name and address for shipped orders, and, for subscriptions, the buyer's email address to set up a customer record on the merchant's Stripe account. We receive payment status and references, and collect any platform application fee that applies. Buyer card details go directly to Stripe and are never received by WebForger. For store payments Stripe also acts under its own agreement with the merchant. | Stripe selects region; primary processing in the United States with EU mirroring. | Policy |
| PayPal Holdings, Inc. United States / Singapore |
PayPal account billing where the customer prefers PayPal over card. | PayPal global; processing locations chosen by PayPal. | Policy |
4. Email and notifications
| Vendor | Purpose | Data region | Privacy |
|---|---|---|---|
| Twilio SendGrid Twilio Inc., United States |
Outbound email for the platform and for hosted sites. Transactional: account, login, password reset, lead-form notifications, billing receipts, shipping and other store emails, and backup delivery of order emails (which are normally delivered through Cloudflare, section 1). Marketing sent by merchants to their buyers: abandoned checkout reminders, campaigns, membership and loyalty notices. Limited WebForger marketing email where the customer opts in. Processes recipient address, sender, message content and delivery and engagement events. | United States. | Policy |
5. Analytics
The vendors below run on webforger.ai. On a hosted site they run only where they have been set up for that site in its Marketing settings, by the site owner or by our team as part of a managed build; for hosted sites we act as the site owner's processor, and the owner can remove them at any time. WebForger's own first-party analytics for hosted sites runs on Cloudflare (section 1) and involves no additional vendor.
| Vendor | Purpose | Data region | Privacy |
|---|---|---|---|
| Google Analytics 4 Google LLC, United States |
webforger.ai: marketing site analytics (which content brings prospects, which pages convert, signup funnel). Hosted sites, where set up: a GA4 property, which we can create under a WebForger-managed account, receiving page views and conversion events (for example form submissions, add to cart, checkout started, purchase) for the site owner's own reporting and advertising measurement. | United States. | Policy |
| Google Tag Manager Google LLC, United States |
Tag delivery container that loads the analytics tag on webforger.ai, and on a hosted site only where a container has been added in that site's Marketing settings. | United States. | Policy |
6. What is not on this list
- We do not use a separate database, search index, log aggregator, or session replay vendor; everything runs inside Cloudflare's stack.
- We do not share your wizard inputs, content, or account information with data brokers, advertising networks, or AI training datasets.
- We do not run session recording on your hosted site, and we do not add third-party advertising or retargeting tags to it by default. Advertising conversion tags load only when they have been added in your site's Marketing settings, by you or by our team at your request.
- You are responsible for the cookie notice and consent your audience is entitled to for analytics and conversion tracking on your site, including any additional tags you install yourself.
7. Changes to subprocessors
Before adding a new subprocessor that materially affects how we process customer data, we will give 14 days' notice in the dashboard and update this page. Routine swaps that do not change the type of data being processed (for example, switching transactional email between two equivalent providers) will be reflected here on the day they take effect, and customers on the Custom plan will receive direct notice.
Our Data Processing Addendum is published on this site and applies to every account. Questions: privacy@webforger.ai.
Document version: 1.1, 22 October 2026 (email provider changed to SendGrid; Stripe store payments and D1 store data added; hosted-site analytics and AI spam screening described; storage region updated; DPA now public). Previous version: 1.0, 29 April 2026.