Sub-processors
Effective date: 20 September 2026
This page is the current sub-processor list referred to in clause 6 of our Data Processing Agreement. It reproduces Annex III of that agreement and names the AI provider in use today. We give at least 30 days' notice before adding or replacing a sub-processor.
The following Sub-processors may process Customer Personal Data on ScrapeBadger's behalf. Providers that process only Account data, billing data or website analytics (for example Stripe, CoinGate, PostHog, Google Analytics, our email providers) are not Sub-processors of Customer Personal Data; they are listed in the Privacy Policy.
| Sub-processor | Processing activity | Location | Transfer mechanism |
|---|---|---|---|
| Hetzner Online GmbH, Gunzenhausen, Germany | Hosting of the servers on which Requests are executed and Output is processed in memory | Germany and Finland (EU) | Not applicable (EU) |
| Cloudflare, Inc. | Edge network, DDoS protection and web application firewall in front of the API; Output transits Cloudflare's network in encrypted form | Global network, headquartered in the United States | EU-US Data Privacy Framework; SCCs |
| Proxy and network infrastructure providers (datacenter, residential and mobile networks; several providers, EU and worldwide) | Routing Requests to Sources; the Source URL and the returned content transit through the provider's network and are not stored | EU and worldwide | Adequacy decision or SCCs where required for a provider outside the EEA. On written request ScrapeBadger will confirm the countries in which its current providers are established and the safeguard applied to each |
| AI model providers used for AI-assisted extraction endpoints (the current provider is named at scrapebadger.com/legal/subprocessors) | Structured extraction from Output when the Customer uses an AI-assisted endpoint; content is sent to the provider to process the Request; the provider may retain it for up to thirty (30) days for abuse monitoring under its API terms and does not use it to train models | European Union or United States, as stated on the sub-processors page | Adequacy decision or SCCs where the provider processes data outside the EEA |
Last updated: 20 September 2026. Changes are notified in accordance with clause 6.
AI extraction providers
Annex III names the AI provider on this page rather than in the agreement, so that a change of model provider does not require a new version of the DPA. As at the effective date above, content sent to the AI-assisted extraction endpoints is processed by:
| Provider | Role | Location | Transfer mechanism |
|---|---|---|---|
| OpenRouter, Inc. | API gateway that receives the Request content and routes it to the model provider below | United States | Standard Contractual Clauses |
Google LLC (Gemini API, model gemini-2.5-flash) | Performs the structured extraction from the content | United States | EU-US Data Privacy Framework; Standard Contractual Clauses |
These providers are engaged only when you call an AI-assisted endpoint —
for example extract_data on the Web Scraping API. Requests that do not use
AI extraction never reach them.
Notify me of sub-processor changes
Leave your address and we'll email you before this list changes. You do not need a ScrapeBadger account.