In short
- Staedy uses a deliberately small number of providers.
- Cloudflare hosts the service. Qonto and Mollie process payments. Four AI providers are used for measurement only.
- AI providers never receive customer email addresses, payment data, website credentials or private project feedback.
- We publish material changes to this list before they take effect. Ask privacy@staedy.com to be notified.
This summary is for orientation only. The full text below applies.
Infrastructure and delivery
Cloudflare, Inc.
- Role
- Hosting, application runtime, database, private object storage, security and request rate limiting, access control, outbound email
- Data
- Connection data, account and order records, private preview and project artifacts, email delivery data
- Location
- Global edge network with EU processing options; company established in the United States
- Transfer basis
- EU Standard Contractual Clauses under Art. 46 (2) (c) GDPR, plus Cloudflare's data processing addendum
Payments
Card payment is initiated from Staedy's checkout and processed directly by Mollie. Qonto provides Staedy's business account and the separate electronic-invoice process; it no longer provides the customer checkout.
Qonto
- Role
- Business account and creation and management of customer invoices
- Data
- Billing address, company and tax details, amount, payment reference, transaction status
- Location
- 18 rue de Navarin, 75009 Paris, France
- Supervision
- Payment institution authorised by the Autorité de contrôle prudentiel et de résolution (ACPR), CIB 16958
- Transfer basis
- Not applicable; processing within the EEA
- Status
- Independent controller for its payment-services, regulatory, fraud-prevention and anti-money-laundering duties
Mollie B.V.
- Role
- Hosted Checkout card-payment processing, fraud prevention, refunds and chargebacks
- Data
- Payment details entered by the customer, amount, transaction status, fraud and risk signals
- Location
- Keizersgracht 126, 1015 CW Amsterdam, Netherlands
- Supervision
- Payment and e-money institution supervised by De Nederlandsche Bank
- Transfer basis
- Not applicable; processing within the EEA
- Status
- Independent controller for payment processing, fraud prevention, regulatory and anti-money-laundering duties
AI providers used for measurement
These providers may receive guest-style research questions and the public hotel or market information needed to answer them. They never receive customer email addresses, payment data, website credentials, unpublished assets or private project feedback.
OpenAI Ireland Ltd. / OpenAI, L.L.C.
- Role
- Measurement of assistant answers
- Location
- Ireland and United States
- Transfer basis
- EU Standard Contractual Clauses; EU–US Data Privacy Framework where applicable
Anthropic PBC / Anthropic Ireland, Ltd.
- Role
- Measurement of assistant answers
- Location
- Ireland and United States
- Transfer basis
- EU Standard Contractual Clauses; EU–US Data Privacy Framework where applicable
Google Ireland Ltd.
- Role
- Measurement of assistant answers
- Location
- Ireland and United States
- Transfer basis
- EU Standard Contractual Clauses; EU–US Data Privacy Framework certification
Perplexity AI, Inc.
- Role
- Measurement of assistant answers
- Location
- United States
- Transfer basis
- EU Standard Contractual Clauses under Art. 46 (2) (c) GDPR
Enterprise or API terms are used with each provider so that submitted content is not used to train their models.
Other recipients
In addition to the processors above, data may be disclosed to:
- legal, tax and security advisors bound by professional confidentiality, where necessary;
- website service providers you explicitly choose, for released implementation views;
- public authorities, where we are legally obliged to disclose.
Changes to this list
We publish material changes to this list, including new processors and changes of location or transfer basis, before they take effect.
If you want to be notified of changes, email privacy@staedy.com and ask to be added to the notification list. Customers with an active contract may object to a new processor on reasonable data protection grounds.