Legal
Sub-processors
This list belongs to the data processing agreement and names every party we engage in processing data you entrust to us.
Two things to know up front, because they shape how you read this list.
The list is short, and that is deliberate. The fewer parties sit in between, the less there is to explain to your own client. We do not add one lightly.
The data passing through your measurement server stays in Europe. The only party involved there is Hetzner. Stripe touches only your payment details and comes nowhere near your measurements.
The list
| party | what for | which data | where |
|---|---|---|---|
| Hetzner Online GmbH | the machines your measurement server runs on, and the storage of your traffic history | everything arriving at your measurement address | Germany or Finland |
| Stripe Payments Europe, Ltd. | collecting payments and producing invoices | name, email address, company details, VAT number and payment details of the account owner | Ireland, with transfer to the United States |
What that means per party
Hetzner
Your measurement server runs on a Hetzner machine, in a data centre in Germany or Finland. Everything your website sends to your measurement address arrives there, and your traffic history is stored there.
Hetzner is a hosting party: they supply the machine and the connection, and do not look into what runs on it. Nothing leaves the European Union.
Stripe
Payment runs through Stripe. They process the payment, produce the invoice and keep the VAT number. Your card details never reach us — those go straight to Stripe.
Stripe processes from Ireland and may pass data to Stripe in the United States. For that they rely on the EU-US Data Privacy Framework and on standard contractual clauses.
Stripe touches only the account owner’s data. What arrives at your measurement address does not go there.
What is not on this list
The destinations of your own tags. If your measurement server forwards data to Google Analytics, Meta or TikTok, that is your processing and not ours. You configure those destinations in your own Tag Manager, and you decide what goes to them. Those parties are therefore not sub-processors of ours.
The tools on tagyard.io itself. Our own website measures its visitors with Google Tag Manager, Google Analytics and Microsoft Clarity. That concerns visitors to our site, not your measurement data. What those three do is set out in our privacy statement.
That distinction is worth making: it saves you a question from your own client that would otherwise start with “why is Microsoft in your list”.
If the list changes
If we add a party or replace one, we tell you at least thirty days in advance at the email address of the account owner. You can object within that period; what happens then is set out in the data processing agreement.
The top of this page states when the current list came into force.