Sub-Processors
Last updated February 19, 2026
RefStack uses a small number of third-party services (“sub-processors”) to deliver the platform. A sub-processor is any company that processes personal data on our behalf as part of providing the RefStack service. This page lists all current sub-processors, what data they receive, where they process it, and the safeguards in place. We review our sub-processor list regularly and will update this page whenever a change is made.
Supabase
United StatesPurpose
Database, authentication, and file storage
Data Processed
Account data, affiliate data, click and conversion records, commission records, email logs
Notes
Managed PostgreSQL on AWS with row-level security and encryption at rest.
Cloudflare
United States (global edge network)Purpose
Application hosting, CDN, DDoS protection, TLS
Data Processed
All traffic passes through Cloudflare's network. No persistent data storage of user data.
Notes
Platform is deployed as a Cloudflare Worker. Cloudflare does not process or store application data.
Resend
United StatesPurpose
Transactional email delivery
Data Processed
Recipient email address, email content (affiliate approval/rejection notifications)
Notes
Only used when a tenant sends notifications to affiliates. Email logs are stored for 90 days.
PostHog
United StatesPurpose
Product analytics and error tracking
Data Processed
Anonymized page views, feature usage events, session metadata, JavaScript error traces
Notes
No personally identifiable information is sent to PostHog. Used for understanding feature usage and capturing production errors.
Plausible Analytics
European Union (Germany)Purpose
Privacy-friendly website analytics
Data Processed
Page views, referrer sources, device type, country (aggregated only, no cookies, no cross-site tracking)
Notes
Cookieless analytics. No personal data or IP addresses are stored. Plausible is fully GDPR-compliant by design. Data is aggregated and cannot be tied to individual visitors.
Changes to Sub-Processors
We will update this page whenever we add, remove, or replace a sub-processor. The “Last updated” date at the top of this page reflects the most recent change. For significant changes that affect the processing of personal data, we will provide advance notice to affected customers by email where reasonably practical. If you have concerns about a new sub-processor, you may contact us within 30 days of the notification to discuss your options.
Questions
If you have questions about our sub-processors, data processing practices, or would like to request a copy of our Data Processing Agreement (DPA), contact us at privacy@refstack.io.