Sub-processors

Data location

Servers, databases and backups are hosted in India, in DigitalOcean's Bangalore data centre.

One core sub-processor

Our infrastructure provider hosts everything. E-mail delivery, file storage and the optional assistant use other providers only where we have configured them. Geolocation runs on our own servers.

This page lists the third parties ("sub-processors") that Web Cue LLC (“TrackCrown”) engages to process personal data on behalf of our customers when we provide the TrackCrown Service, as described in our Data Processing Addendum and Privacy Policy. It also lists service providers we rely on that receive no personal data, and explains how we announce changes.

1. Current sub-processors#

Sub-processor	Service provided	Personal data processed	Location of processing
DigitalOcean, LLC (United States)	Cloud infrastructure: the virtual servers that run the Service, the storage that holds its databases and, where enabled, private object storage for off-site backups	All personal data held in the Service: click, impression and conversion records, account data and contact-form messages	India — Bangalore data centre (BLR1)

Transfers of personal data from the European Economic Area, the United Kingdom and Switzerland to this sub-processor are protected by the European Commission's Standard Contractual Clauses (with the UK and Swiss supplements) in our agreement with it. If we start storing data in any other location, we will list it here first under the notice procedure in section 5.

2. Optional sub-processors#

We use the following providers only where we have configured them for the Service. While one is not configured, the feature it powers is off or works without it, and the provider receives nothing. When we turn one on, we add the provider to the table in section 1 under the notice procedure in section 5.

Provider	When it is used	Personal data processed
E-mail delivery provider (SMTP)	Sending account e-mails — invitations, password-reset and verification links, notifications and scheduled reports. Without it, administrators copy invitation and reset links from the panel instead	Recipient's e-mail address and the content of the message
S3-compatible object storage (for example DigitalOcean Spaces, Amazon S3 or Cloudflare R2)	Storing files uploaded to the Service, such as partner and advertiser documents and creatives. Without it, files are stored on our own servers	The uploaded files and any personal data they contain
Anthropic, PBC (United States)	The optional in-app assistant, which answers questions about a workspace using read-only access limited to the signed-in user's role	The questions the user asks and the workspace data the assistant reads to answer them, such as report figures and click or conversion records

3. Providers that receive no personal data#

Provider	Role	What it receives
Let's Encrypt (Internet Security Research Group)	Certificate authority that issues the TLS certificates for our hostnames and tracking domains	The hostnames to be certified and our administrative contact address; no data about visitors or users
ZeroSSL	Alternative certificate authority that our web server uses automatically if Let's Encrypt is unavailable	As above
DB-IP	Supplier of the IP geolocation and network databases (DB-IP Lite, licensed under CC BY 4.0)	Nothing: we download the database files and every lookup runs on our own servers
Google Web Risk (Google LLC)	URL reputation lookups, where enabled: we check the hostnames that tracking links redirect to, and our own tracking domains, for malware, phishing and unwanted software	Hostnames only; no personal data
Spamhaus and SURBL	Domain and IP blocklists queried over DNS to monitor the reputation of our tracking domains	Our tracking-domain names and our servers' IP addresses; no personal data

4. Recipients chosen by customers#

The following receive data only when a customer configures them, on that customer's instructions. They are recipients chosen by the customer, not our sub-processors, and they process the data under their own terms with the customer.

Recipient	When	Data sent
Google Ads	The customer publishes an offline-conversion feed or connects a Google Ads account for conversion uploads	The conversion events the customer configured: conversion action, time, value, currency and order reference, the Google click identifier (gclid, gbraid or wbraid) and, where the conversion includes them, SHA-256 hashes of an e-mail address or phone number
Meta (Conversions API), TikTok (Events API) and Microsoft Advertising (UET conversions)	The customer adds a conversion-API postback	The conversion events the customer configured: event name, time and identifier, value, currency and order reference, the platform's click identifier, the IP address and user agent recorded with the click, a hash of our click ID, the page address when known and SHA-256 hashes of an e-mail address or phone number where the conversion includes them
Google Ads, Meta, TikTok and Microsoft Advertising (cost import)	The customer connects an ad account to import ad spend	Nothing about visitors: we read campaign spend from the customer's account
PayPal	The customer pays partners through PayPal Payouts	The partner's PayPal e-mail address, the amount and currency, and the payout note
Partners' and customers' own systems, and storage the customer connects	The customer sets up postbacks, webhooks or raw-data exports	The values and records the customer chooses to send

5. How we announce changes#

At least 30 days before a new sub-processor starts processing personal data for our customers, we update this page and notify customers' account owners by e-mail or in the panel. Customers may object on reasonable data-protection grounds within 30 days, as set out in section 6 of our Data Processing Addendum. If we must replace a sub-processor urgently to keep the Service secure or available, we may do so at once and will notify customers promptly.

6. Change history#

Date	Change
2026-10-12	Sub-processor list published.
2026-10-12	Added the optional sub-processors (e-mail delivery, S3-compatible storage, Anthropic), Google Web Risk and the DNS blocklists, and the recipients customers can configure (Google Ads uploads, conversion APIs, cost import, PayPal Payouts).

7. Contact#

Questions about our sub-processors: privacy@trackcrown.com.

Web Cue LLC
16192 Coastal Highway, Lewes, DE 19958, USA
Registration: Delaware State File No. 7576591
Country of incorporation: United States
Privacy enquiries: privacy@trackcrown.com

Questions about this document?

Write to privacy@trackcrown.com or use our contact form.

Sub-processors and data location