Sub-processors

What this list is

Clause 8 of our Data Processing Addendum commits us to naming every third party that processes personal data on our behalf. This is that list. It covers the WPI Components platform, the support portal, and this marketing site.

Two sections at the end matter as much as the table itself. One names the vendors that are in our stack but do not process personal data for us. The other names the integrations that exist in our codebase and are switched off in production — because a security reviewer who greps our repository will find them, and we would rather they read about it here first.

Platform sub-processors

These apply to dash.wpintegrate.com, the API behind it, the embeddable components, and the support portal.

This marketing site

wpintegrate.com is a public brochure site. It holds no account data and no end-user submissions, but it does run advertising and behavioural analytics, and it would be dishonest to leave that out of a document about who sees what.

A limit on this section, stated rather than hidden. Every other row on this page was read out of our repository, so it can be checked. The Google Tag Manager container cannot be: its contents are configured in Google's interface, a tag can be added to it without a code change or a deploy, and nothing in our source tree records what it currently loads. Any vendor whose tag sits inside that container is receiving data from visitors to this site and is not named on this page. Until the container has been audited and its contents pinned, treat this section as complete only for the tags we load from our own source code. That audit is [TO BE COMPLETED].

Microsoft Clarity was removed from this site on 2026-08-13 and is no longer a sub-processor. Until that date it recorded session replay for visitors to these public pages — mouse movement, clicks, scrolling, and navigation. Its row has been deleted from the table above rather than left as a vendor we no longer use, but the history is not being dropped with the tag: our Privacy policy states that it ran, that it was not disclosed while it did, and what remains held by Microsoft.

Inside the embedded widgets: none

The component bundles your visitors load contain no third-party analytics, no session recording, and no advertising SDK. None of the vendors above is loaded by a component on your site. This is a recorded architectural decision rather than a setting — there is no switch to turn one on for a single account, because the code is not in the bundle.

We count component views on our own servers, per account per billing cycle, to enforce plan limits. That is a count of our API being called. It requires no tracker on your visitors and builds no profile of them. Embedding one of our components therefore does not, by itself, add a line to your cookie banner or a sub-processor to your own privacy notice.

Fonts are ours, as of 13 August 2026. Until that date, picking a non-system font for a component made the widget load a stylesheet from fonts.googleapis.com — a request from your visitor's browser, on your page, disclosing their IP address to Google. The five families are now served from cdn.wpistatic.com alongside the component code. Every font we offer is SIL Open Font License 1.1, which is what lets us host them ourselves. There is no longer any font setting that causes a third-party request.

Requests to a third party are still possible from inside a component, and every one of them is switched on by you, using your vendor account:

• Google Tag Manager — only when you set your own container ID on a component.
• Google reCAPTCHA — only when you enable it on a booking or form component with your own site and secret keys.
• A map SDK — only on the Maps component, and only with your own API key: Azure Maps (atlas.microsoft.com) by default, or Google Maps (maps.googleapis.com) if you select it.

These are your relationships with those vendors, not ours, so they are not our sub-processors — but they are yours to disclose, and we would rather you learned that here than from an auditor.

In the stack, not sub-processors

• Cloudflare — authoritative DNS for wpintegrate.com. The proxy is disabled on the hosts this platform serves, so Cloudflare does not sit in the request path for them and does not terminate their TLS.
• The component CDN — component JavaScript and the widget webfonts are served from cdn.wpistatic.com, a separate registrable domain chosen specifically so that it sits outside the scope of our session cookie. No customer-uploaded file is ever served from it. The origin is DigitalOcean object storage, already listed above.

In the code, not enabled

The following integrations exist in our codebase and are inert in production, because the environment variables that gate them are not set on the production application. If any of them is switched on, this list will be updated and notice given under clause 8 of the DPA before it processes anything.

• Anthropic — an assistant that drafts support and lifecycle email for a human to approve. If enabled, ticket and account context would be sent to Anthropic. Not enabled.
• Stripe — a payment step for booking components that take a deposit. Not enabled. Subscription billing is Polar, which is enabled and listed above.
• Google Analytics 4 on the dashboard — a mirror of the PostHog event stream, restricted by design to pseudonymous properties. Not enabled. GA4 on this site is a separate matter and may be firing through the Google Tag Manager container listed above.

Changes to this list

We will give notice before adding or replacing a sub-processor, with a period of [TO BE COMPLETED] in which you may object on reasonable data protection grounds. To be notified, write to privacy@wpintegrate.com and ask to be added to the sub-processor notice list. The date at the top of this page changes whenever the list does.

Contact

Questions about anything on this page: privacy@wpintegrate.com. The contract terms that govern it are in the Data Processing Addendum; how we handle data as a controller in our own right is in the Privacy policy.