Legal
Subprocessors
Last updated: April 27, 2026
AgentBuild uses the following subprocessors to provide the Service. Each is bound by a data-protection agreement that includes appropriate safeguards for international data transfers (Standard Contractual Clauses where applicable). We will give active customers at least 30 days’ notice before adding or replacing a subprocessor that processes personal data.
| Subprocessor | Purpose | Data processed | Region |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, edge compute, DNS, R2 object storage, D1 customer-site databases, Workers Browser Rendering | Customer Content; site visitor IPs and request metadata; domain DNS records | Global edge; primary metadata in US |
| Supabase, Inc. | AgentBuild platform database (accounts, API keys, site registry, billing) | Account data, hashed API keys, billing records, platform events | US (us-east-2) |
| Stripe, Inc. | Payment processing | Cardholder data, billing address, transaction history | US, EU |
| name.com, Inc. (a Donuts company) | Domain registrar | Domain registrant contact information (name, postal address, email, phone) — required by ICANN | US |
| AgentBuild Inbox (operated by AgentBuild on Cloudflare Workers) | Transactional email — receipts, renewal reminders, security notices, customer-site form notifications | Recipient email address, message contents | Cloudflare global edge |
| PostHog Inc. | Marketing-site analytics in cookieless mode | Aggregate page views and events tied to an in-memory identifier that resets on each page load | EU |
| Sanity.io | Marketing-site blog content (no end-user personal data) | None (editorial content only) | EU |
| Dub, Inc. | Referral and affiliate link tracking on the marketing site | Click events, referral codes | US |
Each subprocessor’s privacy policy and data-processing terms are available on its website. AgentBuild’s customer Standard Contractual Clauses for data transfers are incorporated by reference into the Customer Terms of Service Section 10.