Subprocessors
Last changed 2 October 2026 · Version 1.1
These are the third-party services that may process personal data when we provide GuardMyMark. Each one is bound by a data processing agreement with us. This page is Annex III of our Data Processing Addendum.
Get notified of changes. Email privacy@guardmymark.com with the subject "Subprocessor updates" and we will email you at least 14 days before we add or replace a subprocessor. Account owners are notified automatically.
Contents
- Subprocessors
- Not subprocessors: services that act on their own account
- Self-hosted tools
- Change history
Subprocessors
| Subprocessor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Hetzner Online GmbH | Application servers, database, encrypted backups | Germany | EU (no transfer) |
| Cloudflare, Inc. | DNS, CDN, the Turnstile anti-abuse check on the free clash check, and object storage (R2, EU jurisdiction) for retained register files and attorney PDF packs | Global, with storage pinned to the EU | Data Processing Addendum with SCCs |
| Resend, Inc. | Transactional and weekly notice email | United States | Data Processing Addendum with SCCs |
| Anthropic PBC | The borderline similarity comparison described in the Privacy Policy, section 4. It receives two mark texts and their Nice classes — never your name, your email address or your watch list. | United States | Commercial Terms incl. Data Processing Addendum; prompts and outputs are not used for training |
| Ahrefs Pte. Ltd. | Website analytics on the marketing pages (Ahrefs Web Analytics): page URL, referrer, browser and device type, and a country derived from the IP address. Cookieless, and not loaded at all if your browser sends Global Privacy Control or Do Not Track. | Singapore, with EU edge processing | Data Processing Addendum with SCCs |
Not subprocessors: services that act on their own account
| Service | Why it is not a subprocessor |
|---|
| Creem | Our reseller and Merchant of Record. Creem sells the subscription to you, takes the payment and handles payment-related support and refunds as an independent controller under its own terms and privacy notice. We never see your card details. | | Google (sign-in) | Used only if you choose "Continue with Google". Google acts under its own terms. | | The trademark offices we read (the USPTO, and the EUIPO and WIPO as access is granted) | Public registers. We read what they publish; we send them nothing about you. | | Certificate Transparency logs and RDAP registries | Public records of issued TLS certificates and domain registrations, read for the lookalike-domain watch. We send them a domain name to look up, nothing about you. |
Self-hosted tools
These run on our own servers at Hetzner in Germany, so no third party receives data through them: Postgres (database), GlitchTip (error tracking), and Grafana/Loki (logs).
Change history
| Date | Change |
|---|---|
| 2 October 2026 | Version 1.1 of this page. Earlier versions are kept in our source history and we send them on request. |