The short version
- Trakily runs on a short list of vendors: DigitalOcean for hosting and Emailit for email.
- Integrations such as Google, Meta or your payment provider are used only when you connect them, under your own accounts.
- Dodo Payments sells our subscriptions as Merchant of Record and handles payment data itself.
- We announce new subprocessors at least 30 days before they start processing customer data.
This summary helps you find your way around. The full text below is what applies.
On this page
A subprocessor is a company Trakily engages that may process personal data on behalf of our customers, as described in our Data Processing Agreement. This page lists them, together with other services involved in running Trakily so you have the full picture.
01Core subprocessors
These vendors process customer data for every Trakily account.
| Vendor | Purpose | Data involved | Location |
|---|---|---|---|
| DigitalOcean | Hosting: the servers that run the Trakily website, dashboard, API, tracking endpoint and background jobs, and the storage for our database and its backups | All data passing through and stored by the Service, including account data, Customer Data, and IP addresses in transit and in server logs | Hosted in the United States |
| Emailit | Sending transactional email: account emails, billing notices, reports and goal alerts | Recipient email addresses and email content, which for alerts can include visit details such as country, city, device, browser, referrer and a name or user id passed through identify() | European Union (Emailit's own data centre in Prague, Czech Republic) |
- Vendor
- DigitalOcean
- Purpose
- Hosting: the servers that run the Trakily website, dashboard, API, tracking endpoint and background jobs, and the storage for our database and its backups
- Data involved
- All data passing through and stored by the Service, including account data, Customer Data, and IP addresses in transit and in server logs
- Location
- Hosted in the United States
- Vendor
- Emailit
- Purpose
- Sending transactional email: account emails, billing notices, reports and goal alerts
- Data involved
- Recipient email addresses and email content, which for alerts can include visit details such as country, city, device, browser, referrer and a name or user id passed through identify()
- Location
- European Union (Emailit's own data centre in Prague, Czech Republic)
If you use a managed proxy subdomain (such as stats.yoursite.com), Let's Encrypt issues its TLS certificate. It receives only the subdomain name.
02Billing for Trakily subscriptions
| Vendor | Purpose | Data involved | Location |
|---|---|---|---|
| Dodo Payments | Merchant of Record for Trakily plans: checkout, payment processing, invoices, tax collection, refunds and the billing portal | Account holder's name, email, billing address and payment details; subscription and usage plan | Global (see Dodo Payments' privacy policy) |
- Vendor
- Dodo Payments
- Purpose
- Merchant of Record for Trakily plans: checkout, payment processing, invoices, tax collection, refunds and the billing portal
- Data involved
- Account holder's name, email, billing address and payment details; subscription and usage plan
- Location
- Global (see Dodo Payments' privacy policy)
Dodo Payments acts as an independent controller for the payment data it collects, under its own terms and privacy policy. It does not receive analytics data about your visitors.
03Services you connect
These services are used only for customers who turn on the related feature. They act under your own agreement with each provider, and we access them with credentials or permissions you grant and can revoke.
| Service | Used for | Data we access |
|---|---|---|
| Stripe, Polar, Lemon Squeezy, Paddle, Dodo Payments, Razorpay | Revenue attribution and subscription metrics | Payments, refunds, subscriptions, customer ids and emails, via your API key and webhooks |
| Google (Search Console, Analytics Data and Admin APIs) | Search reports, health alerts and Google Analytics 4 imports | Read-only search performance and aggregated analytics for properties you choose, plus the connected Google account email |
| Google sign-in | Signing in with a Google account | Your name, email address and profile photo |
| Meta (Marketing API) | Ad spend and performance | Read-only ad account, campaign and ad performance data (ads_read), plus the connected Facebook user name |
| Slack, Discord | Delivering alerts to a channel | The alert message you configure; nothing is read back |
- Service
- Stripe, Polar, Lemon Squeezy, Paddle, Dodo Payments, Razorpay
- Used for
- Revenue attribution and subscription metrics
- Data we access
- Payments, refunds, subscriptions, customer ids and emails, via your API key and webhooks
- Service
- Google (Search Console, Analytics Data and Admin APIs)
- Used for
- Search reports, health alerts and Google Analytics 4 imports
- Data we access
- Read-only search performance and aggregated analytics for properties you choose, plus the connected Google account email
- Service
- Google sign-in
- Used for
- Signing in with a Google account
- Data we access
- Your name, email address and profile photo
- Service
- Meta (Marketing API)
- Used for
- Ad spend and performance
- Data we access
- Read-only ad account, campaign and ad performance data (ads_read), plus the connected Facebook user name
- Service
- Slack, Discord
- Used for
- Delivering alerts to a channel
- Data we access
- The alert message you configure; nothing is read back
04Public data sources
To find public posts linking to your website, convert currencies, look up visitor locations and show website icons, Trakily uses these public services. We send them at most search terms such as your domain name or keywords, a post id or a website's domain; we do not send them your analytics data or your visitors' data.
| Service | Used for |
|---|---|
| Reddit API | Finding public Reddit posts that link to your website |
| Hacker News (Algolia search API) | Finding Hacker News submissions that link to your website |
| Bluesky (public AppView API) | Finding public Bluesky posts that link to your website |
| X (public syndication data) | Fetching X posts you paste so they can be shown and their shortened t.co links matched to your traffic; post images load from X when you view them |
| Frankfurter | Daily currency exchange rates for converting revenue into your reporting currency |
| DB-IP | Downloading the IP-to-location database that runs on our own servers; no data is sent to DB-IP. IP geolocation by DB-IP (db-ip.com), licensed under CC BY 4.0 |
| DuckDuckGo icon service | Website icons shown next to referrers in the dashboard; your browser requests them directly, sending the referring domain (and, as with any web request, your IP address) |
- Service
- Reddit API
- Used for
- Finding public Reddit posts that link to your website
- Service
- Hacker News (Algolia search API)
- Used for
- Finding Hacker News submissions that link to your website
- Service
- Bluesky (public AppView API)
- Used for
- Finding public Bluesky posts that link to your website
- Service
- X (public syndication data)
- Used for
- Fetching X posts you paste so they can be shown and their shortened t.co links matched to your traffic; post images load from X when you view them
- Service
- Frankfurter
- Used for
- Daily currency exchange rates for converting revenue into your reporting currency
- Service
- DB-IP
- Used for
- Downloading the IP-to-location database that runs on our own servers; no data is sent to DB-IP. IP geolocation by DB-IP (db-ip.com), licensed under CC BY 4.0
- Service
- DuckDuckGo icon service
- Used for
- Website icons shown next to referrers in the dashboard; your browser requests them directly, sending the referring domain (and, as with any web request, your IP address)
05Changes to this list
- We update this page at least 30 days before a new subprocessor starts processing customer data, except in an emergency needed to keep the Service running, in which case we update it as soon as possible.
- To get an email when this list changes, write to [email protected] from your account email with the subject “Subprocessor updates”.
- You can object to a new subprocessor as described in the DPA.
Current list as of the “Last updated” date at the top of this page.