AMP Studio LTD (“AMP Studio”, “we”, “us”) uses a small number of third-party service providers (subprocessors) to operate the LnkFlow service. Where we process personal data on behalf of our customers — such as the click and visitor data described in section 3.4 of our Privacy Policy — these providers may process that data under contract, only on our instructions, and only as needed to deliver the Service.
This page is the authoritative, current list. We will update it before a new subprocessor begins processing customer personal data; you can ask us at support@appitstudio.com to be notified of changes.
Current subprocessors
| Subprocessor | What they do for LnkFlow | Data touched | Location & transfer safeguard |
|---|---|---|---|
| Cloudflare, Inc. | Content-delivery network and edge compute: serves every tracked-link redirect, terminates TLS for branded domains, derives the approximate (network-level) geolocation described in our Privacy Policy, and stores link-routing data in its edge key-value store. | The HTTP request of each link click (IP address, user-agent and headers), edge-derived geolocation and network metadata, and link-routing data (slugs, destination URLs). | Global edge network; Cloudflare, Inc. is US-headquartered. Processing under the Cloudflare Customer Data Processing Addendum, incorporating the EU Standard Contractual Clauses. |
| Cloudways (DigitalOcean, LLC) | Cloud hosting of the LnkFlow application and database. | All Service data: account data, click records, conversion events, and encrypted integration credentials. | Hosted in a European Union data centre (Amsterdam, the Netherlands). Provider data-processing terms with EU Standard Contractual Clauses cover any access from outside the EEA (e.g. support). |
| Stripe | Payment processing for paid plans, and — where a customer connects it — the optional per-account Stripe webhook used for conversion attribution. | Billing details of our customers (card details go directly to Stripe and never touch our servers); conversion-event data, including buyer details, for customers who connect the Stripe webhook. | US-headquartered with EU entities. Processing under the Stripe Data Processing Agreement, incorporating the EU Standard Contractual Clauses. |
| WorkOS, Inc. | Secure sign-in / authentication. | Name, email address, and authentication identifiers of account holders. | US-headquartered. Processing under the WorkOS Data Processing Agreement, incorporating the EU Standard Contractual Clauses. |
| Bunny Fonts (BUNNY WAY d.o.o.) | Privacy-friendly web fonts on our marketing website. | Serves font files without setting cookies or logging personal data. | EU company (Slovenia); no personal data is stored. |
| Google Ireland Limited (Google Tag Manager, Google Analytics 4) | Measurement of our own marketing website (lnkflow.io) only: Tag Manager loads our measurement tags and Analytics 4 reports aggregate page views, traffic sources and on-site journeys. Not used on the tracked-link redirect path and not used for customer click data. | Marketing-website visitors: page and device data, a randomly generated cookie identifier
(_ga), and a truncated IP address. |
EU contracting entity (Ireland); Google LLC is US-headquartered. Processing under the Google Ads Data Processing Terms, incorporating the EU Standard Contractual Clauses. |
| Hotjar Ltd | Aggregate heatmaps and session recordings of our marketing website, used to find usability problems. | Marketing-website visitors: page interactions, device and browser data, and a first-party cookie identifier. Form-field keystrokes are suppressed. | Malta (EU), with sub-processing in the EEA and US under the Hotjar Data Processing Agreement, incorporating the EU Standard Contractual Clauses. |
| DataFast (datafa.st) | Cookie-mode page-view, session, returning-visitor, traffic-source, and journey analytics for our marketing website, subject to the regional policy and visitor choices described in our Privacy Policy. | Marketing-website visitors: page URL, referrer, coarse device data, and pseudonymous first-party visitor and session cookie identifiers used for returning-visitor and journey measurement. | Processing under the provider’s published data-processing terms; see datafa.st for its current processing locations and safeguards. |
Tools you connect are not our subprocessors
Analytics and advertising integrations that you connect to your LnkFlow account — for example Google Analytics 4, the Meta Conversions API, DataFast, Mixpanel, or Segment — receive click data at your direction and act for you, not for us. They are your service providers (or independent controllers), not AMP Studio subprocessors, and your use of them is governed by their own terms. See section 6 of our Privacy Policy.
Questions
For questions about this list, our data-processing terms, or vendor due diligence, contact us at support@appitstudio.com.