1. How to read this list
BoostYard LLC owns and operates Blogged and appoints the subprocessors listed here to process Customer Personal Data when delivering the service. The list reflects providers configured in production as of the effective date. Provider locations describe primary entities or infrastructure and do not promise that support, resilience, or onward processing occurs only in one country. Provider terms and lawful transfer mechanisms apply.
2. Core subprocessors
| Provider | Purpose | Data involved | Primary location |
|---|---|---|---|
| Google LLC and Google affiliates | Firebase App Hosting, Cloud Run, Firestore, Cloud Storage, Authentication, logging, queues, domain services, Vertex AI generation and image processing, Google Sign-In, customer-authorized Search Console access, and consent-gated Google Analytics 4 product analytics | Account and workspace data, Customer Content, prompts and output, files and images, integration tokens, search performance, logs, device data, customer-blog data, and pseudonymous product interaction and performance events | United States and Google Cloud locations. Firebase Authentication is US-only; other Firebase and Google Cloud services may use global infrastructure |
| Stripe, Inc. and applicable Stripe affiliates | Checkout, subscriptions, trials, invoices, tax calculation, promotion codes, payment recovery, and billing portal | Customer and billing identifiers, business name, email, billing address, tax ID, payment method and outcome, plan and subscription records | United States and other locations described by Stripe |
| Exa Labs, Inc. | Public-web search and retrieval for customer-directed research, competitor discovery, evidence, and claim validation | Search queries, domains, public-source context, and retrieved public web results. Queries are not intended to include personal or confidential information | United States |
| Plus Five Five, Inc. (Resend) | Transactional trial, billing, payment-recovery, bounce, and complaint email processing | Recipient email, message content, message identifiers, delivery status, bounce and complaint details | United States and Resend's listed subprocessors |
| Microsoft Corporation | Microsoft Clarity product, documentation, and marketing-site interaction analytics | IP-derived location, device and browser data, rendered page data, navigation, clicks, scrolls, session and interaction events. Form input text is masked by Clarity | United States and Microsoft processing locations |
3. Customer-directed services
The following services are not Blogged subprocessors merely because a customer configures Blogged to load or contact them. They are recipients selected and controlled by the customer, and the customer must maintain the appropriate account, terms, disclosures, lawful basis, and data-processing arrangement:
- Google Analytics 4 and Google Tag Manager
- Meta Pixel
- LinkedIn Insight Tag
- TikTok Pixel
- Any custom head code, script, pixel, analytics, chat, advertising, or embedded service added by a customer
- Any lead webhook, CRM, automation endpoint, or other customer-configured recipient
- A customer's registrar, DNS, reverse proxy, content-delivery, or domain provider
4. Public website resources
Blogged's public marketing pages load fonts from Google Fonts and currently reference public media served from a Cloudflare R2 delivery domain. These resources receive ordinary network request data. Google is already listed above. Cloudflare's role for that public asset is content delivery rather than processing private Customer Content.
5. Changes and objections
Blogged will update this page when it authorizes a new or replacement subprocessor to process Customer Personal Data. Under the Data Processing Addendum, a customer may object on reasonable data-protection grounds within 15 days after the posted effective date. Email hi@blogged.dev with the workspace, affected provider, and specific grounds for the objection.
A provider may change its legal entity, infrastructure, or own subprocessors. Blogged links to provider terms in its internal vendor records and reviews material changes as part of its service-provider management. Contact Blogged if you need the current provider legal documentation for procurement or a transfer assessment.
Questions about this policy?
Include the relevant workspace, customer blog, public URL, or account email so the request can be routed without collecting unnecessary information.
Email hi@blogged.devRelated policies