Legal
Subprocessors
Last updated: 2 October 2026
ELIM GROUP LLC ("estype", "we") uses a small number of third parties to run the estype service. Those that process customer data on our behalf are our subprocessors under our Data Processing Addendum. This page is Annex III of that DPA.
1. About this list
A subprocessor is a company we engage that processes personal data our customers put into estype (customer data), or the account data of the people who use it. Each one is bound by a written contract to process data only to provide its service to us and to protect it to a standard no lower than our DPA. For how we handle personal data as a controller, see our Privacy Policy.
The service and its databases are hosted in the European Union. Where a subprocessor processes personal data outside the EEA or the UK, the transfer is covered by the Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum, or by an adequacy decision.
2. Subprocessors
| Subprocessor | Purpose | Data it processes | Location |
|---|---|---|---|
| Google Cloud (Google) | Hosting the service: the server, its data disk, the databases, uploaded files, backups, secrets, and service logs and metrics | All customer data and account data, including uploaded files, plus request logs (IP address, user agent, time) | Belgium (europe-west1) for the service, files and disk snapshots; Finland (europe-north1) for the continuous backup replica |
| Cloudflare, Inc. | DNS for estype.com. The network edge and TLS for customers' own domains served through Cloudflare for SaaS. Turnstile bot checks on forms that use them. R2 storage of files uploaded through job application forms, until they are delivered. R2 storage of the weekly off-site backup copy. | Traffic to customers' own domains (requests and responses, IP addresses); the form's bot check token and the visitor's IP address; uploaded application files such as CVs, held at most about one day; the weekly backup copy of each workspace database, encrypted, kept 8 weeks | Cloudflare's global network for traffic; R2 files and backup copies stored under R2's EU jurisdiction |
| Slack Technologies | Operational alerts to our team's private channels | Workspace names, the kind of integration affected, error messages and codes, and record identifiers. Alerts are designed to carry codes rather than the content of records. | United States |
3. Payments: Paddle
Paddle.com is the Merchant of Record for every estype order: it sells the subscription to you, takes payment, and handles tax, invoices and refunds. For that purchase data Paddle acts as an independent controller, not as our subprocessor, under its own privacy notice. We list it here so the picture is complete.
| Company | Purpose | Data | Location |
|---|---|---|---|
| Paddle.com | Checkout, payments, tax, invoicing, refunds | The buyer's name, email, country, payment details and order. We receive the subscription, its plan and status, and the buyer's name and email; card details never reach us. | United Kingdom, with Paddle's own providers |
4. Providers that receive no customer data
These providers help us run estype but do not process customer data, so they are not subprocessors. We list them for transparency.
- Better Stack: external uptime monitoring. It checks our public health endpoints every 3 minutes from the EU and receives heartbeat signals from our scheduled jobs. The checks and heartbeats carry no customer data.
- Cloudflare Web Analytics: cookieless page view counts for estype.com only, not for the app or customers' sites.
- Notion and Slack, as our team's own tools for enquiries sent through the estype.com contact form. That is our data as a controller, described in our Privacy Policy.
5. Services you connect are not our subprocessors
estype connects to services you choose: for example Webflow, Ashby, Notion, Slack, Quire, Esteem, banks and payment providers, and your own websites and webhooks. When you connect one, data flows between it and your workspace on your instruction, using credentials you provide, under your own contract with that service. Those services are your providers, not our subprocessors, and they are not listed here. The same applies to any AI agent or script you run against estype through the CLI or API.
estype has no AI model inside the product and does not send customer data to any AI provider.
6. The off-site backup copy
Once a week we copy every database outside Google Cloud, to Cloudflare R2 under its EU jurisdiction, so that the data survives even the loss of our cloud account. The copies are encrypted, access is limited to our operators, each copy is checked against its checksums, and copies are kept for 8 weeks.
7. How we tell you about changes
- At least 30 days before a new or replacement subprocessor starts processing customer data, we update this page and email the owners of every workspace.
- You may object on reasonable data protection grounds within those 30 days by writing to privacy@elim.io. How objections are handled is set out in section 8.4 of our DPA.
- If someone else in your organisation needs these notices, or you are evaluating estype and want them, ask privacy@elim.io to add their address.
8. Change log
| Date | Change |
|---|---|
| 2 October 2026 | List first published. |