| Cloudflare | all traffic metadata (IP, user agent, country), TLS-terminated requests | DNS, CDN, tunnel, DDoS and bot protection | global | Cloudflare's standard data processing terms |
| Backblaze B2 | private uploads (scan photos, exports), client-side encrypted backups, public card images (no personal data) | storage | provider's storage region; backups encrypted before upload | Backblaze's standard data processing terms |
| Resend | recipient email, message content (codes, invites, exports links) | transactional email | US | Resend's standard data processing terms |
| Anthropic | card photo with metadata removed; card names for judgments; no account identity | card recognition, trade explanation | US | Anthropic's standard commercial terms |
| Stripe | email, name on billing, payment method (entered on Stripe), billing country | Pro payments (not live yet) | US/global; Stripe is processor and independent controller for fraud and compliance | Stripe's standard terms (not used yet) |
| Hosting provider | the server (all data, disk-level) | hosting | provider's data centre | hosting provider's standard terms |
| GitHub | source code only; no personal data in repos or issues | development | US | n/a |
