Every processor that can touch your data, and exactly what it does. The DPDP Act requires a complete notice, and a notice with a gap in it is not complete.
Current
| Service | What it does | What it can see |
|---|---|---|
| Hostinger VPS (India/EU region) | Runs the site and stores the database | Everything stored, at rest on that machine |
| Let's Encrypt | TLS certificate | Nothing — it certifies the domain, not the traffic |
| GitHub Actions | Deploys code to the server | The code. No user data: production data never leaves the server |
That is the whole list today.
Deliberately absent
- No analytics provider. No Google Analytics, no alternative. The site currently measures nothing about you.
- No advertising network.
- No content delivery network in front of the site.
- No email provider yet — which is why account emails are not sending. It will be listed here before it is switched on.
- No WhatsApp provider yet, for the same reason.
When this changes
Any new processor is added to this table before it starts receiving data, not after. If a change materially affects what happens to your data, account holders are told.
Sub-processors
None of the above is permitted to use your data for its own purposes, or to pass it on.