Subprocessors
The services Morgan Jonasson Consulting AB uses to run Spool Cloud, what each does, and which data it handles.
Last updated 21 October 2026.
Under our data processing agreement, these subprocessors may handle personal data in your team's content. Each is bound by a data processing agreement with the same protections as ours. The table also names the services that handle data we hold as controller, as the Privacy notice describes.
| Service | What it does | Which data | Where | Transfer basis |
|---|---|---|---|---|
| Cloudflare, Inc. | Runs Spool Cloud: the website, the service, its databases, the team projects' live copies and their backups. | All of it: accounts, teams, team content, shares, comments, billing state and connection data. | Accounts, teams and billing state: databases held in the EU. Team projects' live copies and history: Cloudflare's network, in a data centre near where the project was first opened, not fixed to the EU. | EU-US Data Privacy Framework; standard contractual clauses in Cloudflare's DPA as the fallback. |
| Stripe | Takes payments, runs subscriptions, invoices and the customer portal, and calculates tax. | Billing contact, company name, address and VAT number, card details (held by Stripe only), invoices. | Stripe's own systems; not fixed by us. | EU-US Data Privacy Framework and standard contractual clauses, as Stripe's DPA sets out. Stripe is an independent controller for some of this data, such as fraud prevention. |
| Resend (Plus Five Five, Inc.) | Sends Spool Cloud's email: sign-in codes, invitations, share and comment emails, and billing notices. | The recipient's email address and name, and the message. | Resend's own systems; not fixed by us. | EU-US Data Privacy Framework; standard contractual clauses in Resend's DPA as the fallback. |
| PostHog, Inc. | Measures the website, spool.page, only when a visitor allows it. Never team content or the app. | Website events, error reports and session recordings, as the Privacy notice lists. | PostHog Cloud EU, Frankfurt, Germany. | EU-US Data Privacy Framework, for any access from the US, under PostHog's DPA. |
| Sign in with Google, for people who choose it. Google acts as its own controller for the Google account. | The Google account's email address, name and identifier, which Google sends us at sign-in. | Google's own systems; not fixed by us. | Google is its own controller: the sign-in takes place on Google's side, under Google's terms and safeguards. |
When this list changes
Before we add or replace a subprocessor, we email every team's admins at least 30 days ahead, and this page changes with a new date. An admin who objects on reasonable data-protection grounds can write to privacy@spool.page within that time, as the DPA describes.