Sub-processors
In effect 14 August 2026
Everyone who processes data on our behalf, and exactly what they get. The list is short because the data is thin — there is no end-user data in any of it, because none was collected. One entry is marked optional, and receives nothing unless you agreed to it on this website.
| Who | What they do | What they see | Where |
|---|---|---|---|
| DeepSeek | Explains a detected finding in plain English | The finding itself: metric names, normalized SQL, file names, stack frames, and before/after numbers. No customer end-user data, because none is collected. | China |
| Googleonly if you agree | Counts visits to this website, if you agreed to it | Pages viewed on sixty.sh, a random browser identifier, approximate location from IP, and five events describing how far through signup a visitor got. Nothing from your application, and nothing about your users — this covers people reading our marketing, not people using your software. | United States |
| Scaleway | Runs the application, the collector and the database | Everything described in the privacy policy, at rest and in transit | France |
What this means in practice
Each of these is bound by a written agreement with us that is no weaker than our agreement with you. Where a provider sits outside the European Economic Area, transfers rely on the European Commission's standard contractual clauses.
The DeepSeek entry is the one customers ask about, so to be plain: after a change is detected, the finding is sent to be explained in ordinary English. The payload is the finding itself — metric names, normalised SQL, file names, stack frames, and the numbers before and after. It contains nothing about the people using your application, because nothing about them is ever collected. It is not used to train models.
That provider is in China, which the European Commission has not found to offer equivalent protection. The transfer therefore depends on standard contractual clauses rather than on adequacy. If you would rather no finding of yours left the EU at all, the explanation step is optional — an instance with no model configured surfaces findings exactly as measured, and nothing is sent anywhere.
The Google entry is the odd one out and worth being exact about. It covers visitors to this website — which pages they read, and how far through signing up they got — and it is the only entry here that receives nothing by default. If you did not agree to analytics, Google's tag is never loaded and nothing about you reaches them from this site. It never sees anything from an instrumented application, because that path does not go through a browser we control and carries nothing about a person in any case. See cookies.
Changes
We will update this page before a new sub-processor starts handling anything, and email account holders. If you object to one, tell us at [email protected] — and if we cannot resolve it, you can end your agreement over it without penalty.