Subprocessors

These companies process personal data on our behalf to run Kibble. Each one is bound by a contract with data protection terms at least as protective as our Data Processing Addendum. We stay responsible for them.

We add a new subprocessor to this page at least 15 days before it processes customer data, and record the change at the bottom. To be emailed when the list changes, ask at [email protected].

Company	What it does for Kibble	Where data is processed	Transfer safeguards
Supabase	Database (all Kibble data, including responses) and sign-in	EU (Frankfurt); support from the US and Singapore	Standard Contractual Clauses (SCCs)
Fly.io	Runs Kibble's API, which receives and delivers responses	EU (Frankfurt)	EU-US Data Privacy Framework (DPF) and SCCs
Vercel	Runs the Kibble dashboard and kibbleforms.com	EU (Frankfurt), served through its global network	DPF and SCCs
Cloudflare	DNS, network security and, for forms that turn it on, Turnstile bot checks (the visitor's IP address is sent for the check)	Global network	DPF and SCCs
Resend	Sends email: notifications of new responses and sign-in codes	US	DPF and SCCs
OpenAI	AI triage of responses, for forms with triage on. Doesn't train on the data; keeps it for up to 30 days for abuse monitoring	US	SCCs

#Not subprocessors

Kibble also sends responses to places you choose, called Destinations: Slack channels, your webhooks, your own Postgres or Supabase database, and your team's email inboxes. They receive data because you instruct us to send it, under your own agreements with those services, so they aren't our subprocessors.

Google and GitHub, if you use them to sign in, confirm your identity to us under their own privacy policies.

#Changes

Date	Change
October 27, 2026	First published