Every company that touches data on our behalf, and what each one sees.
Last updated: 22 July 2026
This is the complete list. We update it before adding anyone new.
| Provider | What it does | What it sees | Where |
|---|---|---|---|
| Google Cloud — Vertex AI | Judges and rewrites comment text | The comment text being assessed. No account details, no email address, nothing identifying you | EU (Netherlands) |
| Google Cloud — Cloud Run | Runs our API | Requests in transit; usage counts. Diagnostic logs identify messages by hash, never by text | United Kingdom (London) |
| Supabase | Accounts, sign-in, database | Your email address, password hash, daily usage counts, subscription status | [SUPABASE REGION — check your project settings] |
| Cloudflare | Hosts this website; DNS | Standard web request data for wardensuite.com | Global edge network |
| Paddle | Payments, as merchant of record | Your name, billing address, payment details and purchase history. We never see your card details | United Kingdom / EU |
Google Cloud's Vertex AI is the only subprocessor that sees the comment text, and it processes it in the EU (the Netherlands), inside the UK / EEA. That is inherent to how Warden works: the judging is done by a hosted AI model, and there is no configuration in which it happens on your own machine.
What it receives is the message text alone. It is not told who you are, what page you were on, or which account made the request — those never leave our own service, and under Google Cloud's terms this data is not used to train their models.
See the privacy policy for how international transfers are handled.
If we add or replace a subprocessor we will update this page, and email account holders where the change materially affects how data is handled.