Subprocessors
The companies that process customer data on critlab's behalf, what for, and how you hear about a change.
Version 2026-11-10 · Effective
Draft · pending legal review
critlab uses a small number of companies to run the service. This page lists them, what each does and what data it touches. It is the list the Privacy Policy and the data processing agreement refer to.
Who helps us
| Company | What it does | Data it touches | When |
|---|---|---|---|
| netcup GmbH (Germany)Processor | Runs the web application, the database (Postgres), the cache (Redis), the realtime service and the prototype sandbox, on a server in a data centre in Nuremberg, Germany. | Everything critlab stores or serves: accounts, workspace content, logs. | Always. |
| Hetzner Online GmbH (Germany)ProcessorPlanned | Application hosting and the database (Postgres), in place of the current host. | Everything critlab stores or serves: accounts, workspace content, logs, once it is in use. | Not in use yet. From the day it takes over from the current host. |
| Cloudflare, Inc.Processor | Object storage (R2) for uploaded prototypes, comment screenshots and images, voice notes, thumbnails, folder documents and images, and database backups. DNS for critlab's own domains. Its API for custom share domains and, where a workspace's custom domain is served through Cloudflare, that domain's traffic. While critlab's public website is a preview on Cloudflare Pages, it also hosts that website and runs its newsletter sign-up form. | Prototype files, screenshots and images attached to comments, DOM snapshots, voice recordings, thumbnails and canvas snapshots, folder documents and images. The database backups: a copy of everything critlab stores, accounts and workspace content included. The hostnames of custom domains. For the newsletter form: the email address you enter and your IP address, which the form uses only to limit abuse and does not store. | Always for storage and backups. The domain API, and any custom-domain traffic, only when a workspace connects a custom domain. The website and the newsletter form only while the preview runs on Cloudflare Pages. |
| Resend, Inc.Processor | Sends email: sign-in codes, invitations, notification emails and the newsletter's confirmation link. Holds the newsletter list. | Recipient email address and the message itself, which can quote up to 300 characters of a comment. For the newsletter: the email addresses of people who signed up and confirmed, and whether they unsubscribed. | Whenever critlab sends you an email. The newsletter list only for people who signed up and confirmed. |
| Functional Software, Inc. (Sentry), EU regionProcessor | Error reporting for critlab's own web application and services. | Technical error details: exception type, stack frames, page route, software release, browser and operating system name and version and, for a signed-in member using the application's own pages, an opaque user id. Never message text, page content, screenshots, comment text or IP addresses, and nothing that identifies a reviewer. | When an error occurs in critlab's own application pages, including the viewer's own code, or in its own web, sandbox or realtime servers. Never inside a prototype, in a page the sandbox serves or in the staging snippet. |
| Paddle.com Market LimitedIndependent controller | Merchant of record for paid plans: takes payment, issues invoices and handles sales tax. | Billing name and contact, plan and payment details, which Paddle collects directly; critlab never sees a card number. | Only on the billing pages, and only once paid plans exist. During the free beta nothing is sold and nothing is sent. |
| Google LLCIndependent controller | Sign-in with Google. | Your name, email address and profile picture, which you allow Google to share when you choose it. | Only if you choose Continue with Google, and only where the instance offers it. |
| Microsoft CorporationIndependent controller | Sign-in with Microsoft. | Your name, email address and profile picture, which you allow Microsoft to share when you choose it. | Only if you choose Continue with Microsoft, and only where the instance offers it. |
Paddle, Google and Microsoft are listed for transparency: each decides for itself how it handles the data it collects from you, so they are independent controllers rather than processors acting on our instructions.
Planned changes
- Hetzner Online GmbH (Germany)Planned to replace the current host before paid plans begin.Planned start: not yet scheduled
Change history
- netcup GmbH (Germany) named as the hosting provider, with a server in Nuremberg, Germany. The row was already on the list and had no name until now.
- Hetzner Online GmbH (Germany) listed as a planned subprocessor. It is not in use yet.
What we do not use
critlab does not send workspace content to any AI model provider or transcription service. In particular it does not use OpenAI or Anthropic. Voice notes are not transcribed, and AI review is not part of the launch. If either ever changes, we will add the provider to this page first and give notice, as described below.
How you hear about a change
Before a new subprocessor starts handling workspace content, we publish it here and email the workspace owners at least 30 days ahead. A workspace owner who objects on reasonable data-protection grounds within that time can write to us, and we will work with them on a solution. If none is possible, they can delete their workspace before the change takes effect.
The date of the latest change is at the top of this page.
Questions
Write to support@critlab.app.