Subprocessors · Crumb

To provide Crumb Cloud (the hosted Service at crumb-app.localhostlabs.net), we rely on the vetted third-party providers below. Each acts as our subprocessor under a contract with data-protection terms, processing personal data only to deliver its part of the Service. This list supplements our Privacy Policy and the sub-processing terms in our Data Processing Addendum.

The self-hosted Community edition uses none of these by default. You run Crumb on your own infrastructure and choose your own providers, so this page does not apply to self-hosters.

Current subprocessors

Provider	Purpose	Processing location
Hostinger	VPS hosting: runs the application server and PostgreSQL database where your workspace data lives	United States
Cloudflare	DNS, TLS, CDN, and the secure tunnel that fronts the application; bot and abuse protection; cookie-free page analytics	Global (edge)
Stripe	Payment processing and subscription billing; stores card details (we never receive full card numbers)	United States
Resend	Transactional email delivery: magic-link sign-in, notifications, and the close-the-loop replies	United States

This website

This marketing website uses two more providers. Neither one is used by the Crumb app or receives your workspace data.

Provider	Purpose	Processing location
PostHog	Product analytics for this website, only after you accept the consent banner (see the Cookie Policy)	United States
FormSubmit (Devro LABS)	Delivers the follow form on this website's roadmap: the email address you enter and the item you follow. FormSubmit is a free service and does not offer a data-processing agreement.	Not published by the provider (operator based in Sri Lanka)

AI runs on our own infrastructure. No third-party AI subprocessor. Crumb's AI features (initiative clustering, AI-drafted tickets, session summaries, and Ask) run on machine-learning models we operate ourselves. Your feedback is not sent to any third-party AI provider and never leaves our servers, so there is no AI subprocessor to list. AI features only run on a plan that includes them and when triggered, and output is best-effort and reviewed before use. Session-replay capture is off unless a workspace explicitly enables it. Even then, it records only after the customer ticks the consent box in the widget's feedback form, and only from that point on. It masks typed input at the source, password and email fields included.

Changes & notice

We keep this page current. Where required by our DPA, customers with an active subscription will be notified of a new or replacement subprocessor before it begins processing their personal data, with a reasonable opportunity to object on legitimate data-protection grounds.

Questions

For questions about our subprocessors, or to request notice of changes, contact [email protected].