The companies that handle your account data for us
A sub-processor is a company we rely on to run Shelf and that handles account data while doing it. This is the whole list.
The short version
- Seven companies handle account data for us, and one of them only if you ask us to post an alert to your own Slack.
- None of them is a data broker or an advertiser.
- We say so on the changelog 30 days before adding one.
The list
| Company | What it does for us | What it sees |
|---|---|---|
| Cloudflare | Serves the pages, passes your requests to our servers, and keeps a short-lived copy of the published figures so they open quickly. | Every request passes through it, including your email address when you sign in. It keeps no account data for us. |
| Oracle Cloud | Rents us the servers that the account server and the database run on. We operate both ourselves. | Everything we store about your account is on these servers. |
| Razorpay | Takes the payment when you buy a plan, and sends a refund back. | What you enter at checkout (the card, UPI or bank details), your email address and the amount. We never see the card. |
| ZeptoMail (Zoho) | Delivers the mail we send: a sign-in code, a receipt, a Briefing, an alert. | The address a mail goes to, and the mail itself. |
| Counts visits to the public pages (Google Analytics). Only if you book a call: holds it on our calendar and makes its Google Meet room. | On the public pages: the page, the site you came from, your browser, and a rough location from your network address. For a call: the time you picked, your email address, and your name, brand or company and note if you typed them. | |
| Microsoft (Clarity) | Records clicks, scrolling and where a visit ends on the public pages, so we can see what is hard to use. It does not run on the signed-in screens. | The public pages as you saw them, your browser, and a rough location from your network address. Never what you type, and nothing of your account. |
| Slack | Receives an alert in your own Slack, and only when you point an alert at a Slack webhook. | The alert you asked for, at the webhook you gave us. |
What is not on the list
The database that holds your account and what you watch is ours. We operate it ourselves on the servers above, so no database company handles your data.
A webhook of your own is not a sub-processor either: an alert you point at your own address is posted there because you asked for it, and nowhere else.
The apps we read are not on the list because nothing about you reaches them. We read their public pages as a guest, with no account of yours and none of ours.
When the list changes
We announce a new sub-processor on the changelog 30 days before it starts handling account data, and a customer under the data processing addendum may object. This page states when it last changed.
Apexlayer Technologies Private Limited, CIN U58201HR2025PTC135312. Registered office: C/O WeWork India, DLF Forum, DLF Cyber City Phase III, Sector 24, Gurugram, Haryana 122002, India. A question about this page goes to legal@apexlayer.in.