I. Effective date
Effective date: 19 June 2026
Processor: The Wall d.o.o., Mestni trg 10, 1000 Ljubljana, Republic of Slovenia (d.o.o. = Slovenian private limited company, equivalent to “Ltd” in English)
This list describes third parties that process personal data on our behalf to deliver the Blekline Services. We update this list when we engage new subprocessors or change processing activities.
Subscribe to changes: email hello@blekline.com with subject “Subprocessor updates”.
Enterprise customers with a DPA receive 30 days' advance notice of material subprocessor changes as specified in their agreement.
II. Infrastructure and hosting
| Subprocessor |
Purpose |
Data processed |
Location |
| Vercel Inc. |
Hosting, CDN, serverless delivery for web app and APIs |
IP address, request logs, app traffic, deployment metadata |
Default SaaS · US (iad1)
Enterprise EU · Frankfurt (fra1)
when EU Residency Addendum applies
|
| Supabase, Inc. |
Managed PostgreSQL database |
Account, workspace, billing metadata, audit events, integration config |
Default SaaS · US
Enterprise EU · Frankfurt
when EU Residency Addendum applies
|
III. Optional infrastructure
| Subprocessor |
Purpose |
Data processed |
Location |
| Upstash, Inc. |
Distributed rate limiting (when UPSTASH_REDIS_* configured) |
Request metadata, rate-limit keys |
US / EU per project region
|
IV. Payments
| Subprocessor |
Purpose |
Data processed |
Location |
| Stripe, Inc. |
Payment processing, subscriptions, invoicing |
Billing email, payment method metadata, transaction records |
United States
EU entities where applicable
|
V. AI and masking
| Subprocessor |
Purpose |
Data processed |
Location |
|
Microsoft Corporation
Azure AI Language — Text Analytics for PII
|
PII detection for cloud masking (/api/mask, MCP blekline_mask_prompt) |
Text submitted for masking (transient, on processing path) |
Default SaaS · US Azure region
Enterprise EU · West/North Europe
when EU Residency Addendum applies
Sidecar local_only: no Azure call — processing stays in customer network
|
VI. Authentication
| Subprocessor |
Purpose |
Data processed |
Location |
| Google LLC |
OAuth sign-in (optional) |
Email, name, profile ID |
United States |
| GitHub, Inc. (Microsoft) |
OAuth sign-in (optional) |
Email, username, profile ID |
United States |
| LinkedIn Corporation (Microsoft) |
OAuth sign-in (optional) |
Email, name, profile ID |
United States |
VII. Communications
| Subprocessor |
Purpose |
Data processed |
Location |
| Resend, Inc. |
Transactional email (auth, billing, enterprise leads) |
Email address, message metadata |
United States |
| MailerLite, UAB |
Marketing email list (if subscribed) |
Email, preferences, campaign metadata |
European Union (Lithuania) |
| Make (Celonis SE) |
Workflow automation (app events → ESP) |
Email, segment tags (minimal) |
EU / US per scenario config |
VIII. Analytics and marketing (marketing site only, with consent)
| Subprocessor |
Purpose |
Data processed |
Location |
|
Google LLC
Tag Manager / Analytics
|
Website analytics when consented |
Usage data, device identifiers |
United States |
|
Apollo.io, Inc.
if enabled via GTM
|
B2B marketing enrichment when consented |
Business contact data |
United States |
IX. Transfer mechanisms
Where personal data is transferred from the EEA/UK to countries without an adequacy decision, we rely on Standard Contractual Clauses (EU Commission 2021/914) and the UK Addendum where applicable, plus supplementary measures as required.
Enterprise customers may execute a Data Processing Agreement with Module Two SCCs. See enterprise sales.
X. Contact
Questions about these Terms of Use:
- Email: hello@blekline.com
- Company: The Wall d.o.o. (Blekline)
- Registered address: Mestni trg 10, 1000 Ljubljana, Slovenia
- Matična številka: SI28305400
- Davčna številka: 9710370000