Who touches which data.

No sub-processor ever receives document content: documents are corrected on your own device and are never sent to us. These are the companies that process personal data on DocVerifyPro’s behalf, what each one receives and why.

Sub-processor	Purpose	Data received	Location
Stripe, Inc.	Payment processing, invoices, subscription management	Billing details, email, plan, amount; card data entered directly into Stripe’s own form	United States
Cloudflare, Inc.	Hosting of the application, licence API, KV storage of licence and seat records, edge logs, cookie-free page-view counter, inbound email routing	Connection data (IP, time, path, user agent); a daily-salted hash of the IP for abuse limits; licence tokens and seat identifiers; email sent to our support and security addresses	Global edge; United States
Cloudflare, Inc. (Workers AI)	Drafting first replies to support email and answering the on-site assistant	The text of the email or question you send — never a document	Global edge; United States
Google LLC (Gmail)	The support inbox: email sent to our addresses is forwarded there	The email you send us	United States
Resend, Inc.	Operator alert emails when the licence service errors; sign-in links and invitations for Team and Studio members	Route, error message and stack trace of a server error — never a document, token or customer email. For sign-in emails: the recipient address and the one-time link	United States

What is deliberately absent

No file storage provider: there are no files.
No OCR, AI or image-processing service ever receives a document: the engine runs in the browser. Workers AI (above) only reads the text of a support email or an assistant question.
No CRM, marketing automation or session-recording tool on the product pages.
No advertising or cross-site tracking pixels.

Change notice

Before adding or replacing a sub-processor we email the billing contact of every Professional Team and Corporate Studio subscription at least 30 days ahead, naming the company, purpose and data involved. A customer who objects on reasonable data-protection grounds may terminate the affected subscription at the end of the current paid period; no further charge is taken.

Verification

The hosts the application is allowed to contact are enforced by its Content Security Policy and listed on the security page. Any host not on that list is blocked by your own browser.