Codunk uses the following named sub-processors to deliver the service. This page is the canonical, up-to-date list — see our privacy policy for the categories and the legal basis on which we share data.
| Category | Vendor | Region | |
|---|---|---|---|
| Application hosting & CDN | Vercel Web app hosting + deployment of user-generated projects | US / EU | Privacy → |
| Application hosting & CDN | Cloudflare DNS, CDN, DDoS protection, deployed-site hosting (R2 + Workers) | US / Global | Privacy → |
| Database, authentication & file storage | Supabase Postgres database, auth, file storage | US / EU | Privacy → |
| AI code generation | Anthropic AI generation via Claude API. Zero-retention: prompts are NOT retained to train models. | US | Privacy → |
| Payment processor / Merchant of Record | Whop Checkout, subscriptions, invoicing, sales-tax compliance | US | Privacy → |
| Transactional email | Resend Auth, security, billing notifications | US | Privacy → |
| Email & build infrastructure | Hostinger Team mailboxes and supporting build tooling | EU (Lithuania) | Privacy → |
| Stock photography | Pexels Imagery for generated sites — no personal data shared | US | Privacy → |
| Error monitoring | Sentry Technical exception capture for service stability | US / EU | Privacy → |
| Product analytics & session replay | PostHog Product analytics, conversion funnels, session replay — loaded only after cookie consent. | EU (Germany) | Privacy → |
| Product analytics & session replay | Microsoft Clarity Heatmaps and session recordings to identify UX friction — loaded only after cookie consent. | US | Privacy → |
| Live chat support | Crisp Customer support conversations you initiate | EU (France) | Privacy → |
Where data is transferred outside the EU/EEA, the transfer is governed by the European Commission's Standard Contractual Clauses (SCCs, Decision 2021/914) and, where applicable, the EU-U.S. Data Privacy Framework. Each vendor listed above has its own GDPR-compliant Data Processing Agreement signed with Codunk.
We may add or replace a sub-processor at any time. Customers under a Data Processing Agreement (Studio plan) are notified by email at least 14 days before any addition or replacement that materially changes processing. To object, reply to that email or write to dpo@codunk.com.