Subprocessors List
Last updated July 10, 2026 · Version 1.0
Effective date: July 10, 2026
1. Purpose of This List
LeonAI LTD ("LeonAI," "we") uses third-party subprocessors to deliver LeonAI Links — our URL shortening, redirect, click analytics, QR code, custom domain, webhook, link-in-bio, team, and API service operated on the LeonAI domains (marketing site, customer dashboard, REST API, and the shared short-link domain, currently short.leonai.io). A "subprocessor" is a third party engaged by LeonAI that processes personal data on behalf of our customers under our Data Processing Agreement (DPA). This page is incorporated by reference into the DPA and identifies each subprocessor, the service it provides, the categories of personal data involved, and the applicable international transfer mechanism. Contact: care@leonai.io.
2. Notification of Changes and Right to Object
We will notify customers of any intended addition or replacement of a subprocessor at least 30 days in advance of the new subprocessor processing customer personal data. To subscribe to notifications, either:
- email care@leonai.io with the subject line "Subscribe to Subprocessor Updates", or
- watch the page at links.leonai.io/legal/subprocessors, where changes are posted with the same 30-day lead time.
Customers may object to a new subprocessor on reasonable data protection grounds within the notice period, following the procedure in the DPA. If we cannot offer a commercially reasonable alternative, the customer may terminate the affected services and receive a pro-rata refund of prepaid fees, as set out in the DPA.
3. Current Infrastructure Subprocessors
| Subprocessor | Entity & Location | Service Provided | Data Categories | Transfer Mechanism |
|---|---|---|---|---|
| Cloudflare, Inc. | Cloudflare, Inc., USA (global network) | Core hosting and delivery: Workers compute, D1 database, Workers KV, R2 object storage, Queues, CDN, DNS, WAF and DDoS mitigation. Coarse visitor location (country/city) is derived from the Cloudflare edge that already terminates the request, so no visitor IP is sent to a separate geolocation vendor | All customer data processed by the Service, including account data, link data, and click/analytics events | EU SCCs (2021/914, Module Three); UK Addendum; Swiss adaptations; EU-U.S. Data Privacy Framework participant |
| Sumit | Sumit Always On It Ltd (company no. 514937374), Israel | Payment processing, subscription billing, and issuance of tax invoices and receipts | Billing contact details, payment card data (held solely by the payment provider; LeonAI never stores full card numbers), invoice and subscription records | Israel is covered by a European Commission adequacy decision (2011/61/EU), so no SCCs are required for EEA transfers |
| Resend | Resend, Inc., USA | Transactional email delivery (receipts, security alerts, quota and verification emails) | Names, email addresses, email content and delivery metadata | EU SCCs; UK Addendum; Swiss adaptations |
| Google LLC (Safe Browsing) | Google LLC, USA | Reputation checks on destination URLs to detect phishing and malware before a link is created or served | Destination URLs submitted for checking; no visitor identifiers | EU SCCs; UK Addendum; Swiss adaptations; EU-U.S. Data Privacy Framework participant |
| Sentry | Functional Software, Inc. d/b/a Sentry, USA | Application error and performance monitoring | Error context that may incidentally include user identifiers (account IDs, truncated IPs, request metadata); server-side data scrubbing is enabled to strip credentials, tokens, and other sensitive values before transmission | EU SCCs; UK Addendum; Swiss adaptations; EU-U.S. Data Privacy Framework participant |
All subprocessors are bound by written agreements imposing data protection obligations no less protective than those in our DPA, including confidentiality, security measures, and audit rights.
4. International Transfers
The Service runs on Cloudflare's global network, so request handling occurs at the data centre nearest the visitor; our primary storage region is Cloudflare's Eastern Europe (EEUR). For personal data originating in the EEA, UK, or Switzerland, transfers to each subprocessor rely on the mechanisms shown in the table above: the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914, Module Two or Module Three as applicable), the UK International Data Transfer Addendum/IDTA, and Swiss adaptations, supplemented where available by the vendor's certification under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions). Cloudflare, Google, Resend, and Sentry are US-based; Sumit is in Israel, which benefits from an EU adequacy decision. Current Data Privacy Framework certification status should be confirmed against the official DPF list.
5. Enterprise, White-Label, and Custom Arrangements
Enterprise customers with white-label deployments, custom domains at scale, or bespoke data-residency requirements may be subject to different or additional subprocessor arrangements (for example, alternative hosting regions or customer-designated email providers). Any such arrangements are documented in the customer's Enterprise agreement or order form, which prevails over this general list for that customer. Enterprise customers may also request a customer-specific subprocessor list and flow-down terms as part of their DPA negotiation.
6. Review and Contact
This list was last reviewed on July 10, 2026 and is reviewed at least annually and upon any subprocessor change. Questions, objections, or subscription requests: care@leonai.io, or write to LeonAI LTD, Avraham Pachornik 17, Ness Ziona, Israel, company registration number 516916954.