Sub-processor List

This page lists third parties that may process personal data to help McQuillen Interactive Pty. Ltd. provide SimpleDiagrams Cloud. It forms part of the Data Processing Addendum. Customer gives the general authorisation described in that DPA for providers that process Customer Personal Data on our behalf. We also disclose providers used for account administration, billing, and service security; listing them here does not make their independent processing subject to Customer's instructions under the DPA. This list does not govern the separately sold SimpleDiagrams Desktop product.

Sub-processors and other service providers

Provider	Purpose and role	Data	Primary processing location
Google Cloud Platform (Google LLC)	Application hosting, managed database, networking, logs, build artifacts, storage, secrets, and backups	Account data, Customer Content, current state, usage, operational logs, and service metadata	australia-southeast1 (Sydney, Australia) for the primary application, database, and Customer Content storage; Google may provide support and resilience from other locations under its terms
Stripe, including Link	Managed Payments merchant of record: checkout, recurring payments, tax handling, invoices, order management, and transaction support through Link. Stripe also processes data for its own payment, fraud-prevention, tax, and legal purposes, not solely as our Sub-processor	Billing contact, email, organisation, address, tax details, payment method, subscription, and transaction data	United States and other locations described by Stripe; full card data is stored by Stripe, not SimpleDiagrams
Postmark, an ActiveCampaign service	Transactional email delivery and newsletter announcements	Recipient name and email, subject, message content, delivery and interaction metadata	United States and other locations described by Postmark
Google reCAPTCHA (Google LLC)	Detecting automated submissions of account signup, newsletter and Contact forms for our service security; Google's handling is governed by its own privacy policy and terms, not Customer's diagram-processing instructions	IP address, browser and device metadata, and page interaction signals collected by Google when the form is shown	United States and other locations described by Google
Sentry (Functional Software, Inc.)	Application error monitoring when enabled	Error stack, request route, device and browser metadata, IP-derived technical data, and limited diagnostic context	United States or the region configured for the Sentry account

Important clarifications

• Excalidraw is bundled open-source client software. SimpleDiagrams does not send scenes to the hosted excalidraw.com service merely by loading the editor.
• No advertising or optional product-analytics provider is currently configured.
• A provider is a Sub-processor under the DPA to the extent it processes Customer Personal Data on our behalf. Account, billing, and platform-security processing outside that scope is described in the Privacy Policy and applicable provider terms. Ordinary software dependencies that receive no data are not Sub-processors.

Changes and objections

We will update this page before adding a provider that materially processes Customer Personal Data and provide notice and an objection opportunity as described in the DPA. Customers may ask questions or object on reasonable data-protection grounds at support@simplediagrams.com.

Change log

Date	Change