Last updated: October 22, 2026 · Controller: WHITEDIT LTD (UK private limited company; product: CodeGateway, codegateway.dev). This list names the third parties that process personal data on our behalf (subprocessors), disclosed under Article 28 UK GDPR / GDPR. Per Section 6 of our Privacy Policy, processors are layered into direct processors (we hold a contract with them) and sub-processors reached through Cloudflare AI Gateway (no direct contract with us; backstopped by the Cloudflare Customer DPA). International transfers: for transfers outside the UK/EU we rely on the UK IDTA or the UK addendum to the EU SCCs and, where available, the vendor's EU–US / UK–US Data Privacy Framework certification.
| Subprocessor | Purpose / data processed | Processing location | Safeguards |
|---|---|---|---|
| Cloudflare, Inc. (US) | All infrastructure: edge compute (Workers), database (D1), key-value and object storage (KV / R2), Queues, Durable Objects, transactional and marketing email (Email Sending), bot protection (Turnstile), AI Gateway and Workers AI (inference routing), operational logs and analytics (Observability / Analytics Engine) | Global edge network; Cloudflare, Inc. in the US; storage locations are assigned by Cloudflare under its Customer DPA and default mechanisms | Cloudflare Customer DPA + SCCs/IDTA; DPF certified. Cloudflare's subprocessor list: https://www.cloudflare.com/gdpr/subprocessors/ |
| Stripe, Inc. (US) | Payments: card top-ups, auto top-up, refunds, saved payment methods. Card numbers never touch our servers (Stripe Checkout) | US | Stripe DPA; DPF certified |
| Google LLC (US) | Sign in with Google (OAuth); website analytics (GA4 / Google Tag Manager, gated by cookie consent); admin import of aggregate metrics via the Analytics Data API; server-side conversion measurement (GA4 Measurement Protocol: purchase events sent to google-analytics.com, identified by the GA client ID, or — absent one — a pseudonymous identifier one-way derived from the user ID; no name or email) | US / global | Google Data Processing Terms; DPF certified |
| GitHub, Inc. (US) | Sign in with GitHub (OAuth) | US | GitHub Privacy Statement / DPF certified |
| Moonshot AI (China) | Direct inference channel for `/v1/responses` (international endpoint api.moonshot.ai). Not currently enabled — off in production; before enabling it we will update this page and put contracts and transfer safeguards in place | No processing occurs while the channel is disabled | Precondition to enable: Article 28 DPA plus a transfer mechanism |
| DeepSeek (China) | Direct inference channel for `/v1/responses` (api.deepseek.com). Not currently enabled — off in production; before enabling it we will update this page and put contracts and transfer safeguards in place | No processing occurs while the channel is disabled | Same as above |
Under the Cloudflare AI Gateway Unified Billing arrangement, Cloudflare forwards inference requests to the model providers below as Cloudflare's own sub-processors. We have no direct contractual relationship with these providers; under the Cloudflare Customer DPA we have signed, Cloudflare is responsible for their Article 28 compliance.
| Model provider | Purpose | Processing location |
|---|---|---|
| Anthropic PBC (US) | Claude inference (via AI Gateway) | US |
| OpenAI (US) | GPT / Codex / image-model inference (via AI Gateway or Workers AI) | US |
| Google LLC (US) | Gemini / Veo / Imagen inference (via AI Gateway google-ai-studio or Workers AI) | US / global |
| xAI (US) | Grok inference (AI Gateway partner channel; no models currently listed) | No processing at present; this page will be updated before any model goes live |
| MiniMax (China) | Inference and video-output CDN (video-product.cdn.minimax.io; AI Gateway partner channel; no models currently listed) | No processing at present; this page will be updated before any model goes live |
| ByteDance / Volcengine (China) | Video-output object storage (*.tos-ap-southeast-1.volces.com; no models currently listed) | No processing at present; this page will be updated before any model goes live |
Note: models that run natively on Workers AI under the `@cf/` prefix (e.g. GLM, Qwen, Moonshot, Clef) execute on Cloudflare infrastructure; the model vendor does not receive your request data. Output files of the video models currently listed are served through short-lived signed links managed by Cloudflare (valid for about 24 hours).
| Tool | Purpose / data processed | Location / note |
|---|---|---|
| Artificial Analysis | Public model benchmark sync | Receives no customer data |
| Wise | Receiving bank for bank transfers (our payee details shown on invoices) | The transfer is executed by the customer's own bank; Wise is not a processor we engage |
We update this page before engaging a new processor or making a material change of purpose, and review it quarterly. Questions: privacy@codegateway.dev (or the contact stated in the current Privacy Policy).