ConsentStack processes Consent Data in the United States. Transfers from the European Economic Area, the United Kingdom, or Switzerland are covered by the Standard Contractual Clauses in section 13 of our Data Processing Agreement.
ConsentStack uses the following sub-processors to provide our services. We notify customers at least 30 days before adding a new sub-processor, in accordance with the same agreement.
| Sub-Processor | Function | Data Processed | Location | Privacy Policy |
|---|---|---|---|---|
| Supabase | Database & authentication | Consent records, user accounts, site configurations | US (AWS us-east-1) | View |
| Cloudflare | CDN, DNS, edge security, rate limiting | IP addresses (transit only), request headers | Global edge network | View |
| Vercel | Application hosting | Application logs, request metadata | US | View |
| Stripe | Payment processing | Billing details, email addresses | US | View |
| Resend | Transactional email | Email addresses, notification content | US | View |
| DeepL | Translation | Consent banner text (no personally identifiable information) | EU (Germany) | View |
| Sanity | Content management | Marketing site content (no personally identifiable information) | US / EU | View |
Last updated: July 31, 2026