Sub-Processors
This page lists the third-party sub-processors that Firstmate BV ("Dalton") engages to process personal data on behalf of its customers when providing the Dalton platform. It forms part of, and is incorporated by reference into, our Data Processing Agreement. For general information on how we handle data, see our Privacy Policy.
Current sub-processors
| Sub-processor | Processing activities | Location of data storage | Data safeguards |
|---|---|---|---|
| Cloudflare | Receiving and routing visitor tracking data from the browser to Dalton's EU infrastructure. | Global edge network (stateless, no data stored at edge) | EU-US Data Privacy Framework (active certification); SCCs via Cloudflare DPA |
| Vercel (Algorithm / API) | Hosting and executing Dalton's optimization algorithm and API. | EU (European servers only) | EU-US Data Privacy Framework; SCCs via Vercel DPA |
| Redpanda | Streaming event data from Dalton servers to database. | EU (AWS eu-central-1, Frankfurt) | SCCs (AWS Standard Contractual Clauses) |
| Tinybird | Storage and querying of visitor event data. | EU (Google Cloud eu-west2, London) | SCCs (Google Cloud Standard Contractual Clauses) |
| New Relic | Application logging for debugging purposes; 14-day retention. | EU (European servers only) | SCCs available via New Relic DPA |
| Supabase | Authentication data of Customer's authorized platform users. | EU (eu-central-1) | SCCs available via Supabase DPA |
Notification of changes
We keep this list current. Before adding or replacing a sub-processor that processes customer personal data, we will give notice by updating this page. Customers may subscribe to change notifications by emailing team@getdalton.com, and then have fourteen (14) calendar days to object to a new sub-processor on reasonable data-protection grounds, as set out in our Data Processing Agreement.
Contact
Questions about our sub-processors or data processing can be sent to team@getdalton.com.