Sub-processors
The service providers that process personal data for Avonao ID, what each does and where, and how we give notice of changes.
The service providers that process personal data for Avonao ID, what each does and where, and how we give notice of changes.
1. What this page is
The service providers that process personal data for Avonao ID on behalf of AVONAO, INC. This list is the sub-processor list referred to in the Data Processing Agreement (Annex 3) and in section 6 of the Privacy Policy.
In plain language: these are the companies that help us run Avonao ID and handle some of your data. We tell businesses 30 days before we add or replace one.
2. Current sub-processors
| Provider | Purpose | Location | Personal data involved | Safeguards |
|---|---|---|---|---|
| Cloudflare, Inc. | Runs the service (Workers), stores account data (D1 databases), delivers our network, DNS, service logs, and sends our emails from no-reply@id.avonao.com (Cloudflare Email Service) | Account data in the region you chose when you signed up (US East, US West, Europe Central, Europe West, Europe North, Asia-Pacific or Oceania; the three European regions under Cloudflare's EU jurisdiction, where the data stays in the EU and Cloudflare chooses the datacenter). Business records and the pseudonymous sign-in index in our home region, US West. Requests are handled on Cloudflare's global network. | Everything the service handles: account data, session data, email addresses and the content of our emails, IP addresses in request logs | Cloudflare's Customer Data Processing Addendum; transfers rely on the EU-US Data Privacy Framework first and the Standard Contractual Clauses second |
| Cloudflare, Inc. (Turnstile) | Bot check on sign-up and business creation | Cloudflare's network | A challenge token, the visitor's IP address and browser signals, as Cloudflare defines | As for Cloudflare above |
| Stripe, LLC | Payments for Avonao ID business plans and for the plans, add-ons and packs members buy on the Avonao platforms (Trustvice, Agined, Intramedial, GoPlainly) through Avonao Billing. Everything is sold with Stripe Checkout and Stripe Managed Payments, where Stripe is the seller of record for the sale and handles payment, tax, invoices and receipts. Stripe also provides the customer portal | As set out in Stripe's Data Processing Agreement | The billing contact and company details given at checkout, the payment method (entered at Stripe only: we never receive card numbers), the items and amount, and the Stripe customer and subscription identifiers | Stripe's Data Processing Agreement; transfers rely on the Data Privacy Framework first and the Standard Contractual Clauses second |
| Microsoft Corporation, with Microsoft Ireland Operations Limited for the EEA, the UK and Switzerland (Microsoft 365) | Company mailboxes behind support@avonao.com, business-support@avonao.com, enterprise-support@avonao.com and the privacy and report addresses | As set out in Microsoft's public Product Terms and Data Protection Addendum | The messages you send to us and our replies | Microsoft's Data Protection Addendum |
Avonao is not a payment provider, a bank or a money wallet and holds no funds for anyone. Avonao Billing is only the central billing entity for the platforms Avonao owns and operates, not for the platforms of other companies; every payment is collected, held and settled by Stripe, a licensed payment service provider, under Stripe's own terms, and where a sale is made through Stripe Managed Payments Stripe is the seller of record for that sale and handles payment, tax, invoice and receipt. For the sale itself Stripe may act as an independent controller, under its own terms. We receive the outcome of a purchase (plan, status, amount and currency, Stripe identifiers) through Stripe's webhook, and never your card number.
Avonao Billing is part of the Avonao Wallet, which AVONAO, INC. operates. It is not a separate sub-processor. The Avonao Wallet is a credentials vault and holds no money.
We have no other sub-processors for the data in section 2, and we use no sub-processor for advertising or data resale. AVONAO, INC. itself operates Avonao ID, Avonao Billing and the Avonao platforms; no other affiliate processes the personal data of Avonao ID.
2.1 Providers you choose
These take part only at your own choice. They may be independent controllers for the sign-in or check on their side, and they are listed so you can see where your data goes.
| Provider | Purpose | Personal data involved |
|---|---|---|
| Google (Google Ireland Limited for people in the EEA and Switzerland; Google LLC elsewhere) | "Sign in with Google" | You sign in at Google. We receive your account identifier and your verified email address, and your name if you allow it. |
| Microsoft (Microsoft Ireland Operations Limited for people in the EEA, the UK and Switzerland) | "Sign in with Microsoft" | Same as above, from your Microsoft account. |
| GitHub, Inc. | "Sign in with GitHub" | Same as above: your account identifier and a verified email address from GitHub. |
| Stripe, LLC (Stripe Identity) | Identity check for Verified. Verified is off by default, and Stripe Identity is used only when it is switched on and you choose to verify. Where and how long Stripe keeps the data is set out on Stripe's Identity privacy page | The identity document and live selfie, processed by Stripe. We keep only the outcome, the date and your trust level, never images or document data. See Verified consent. |
A business that connects its own identity provider chooses that provider itself; it is not a sub-processor of Avonao.
2.2 Analytics and monitoring tools (planned, none live)
On our own websites we plan to use analytics and error-monitoring tools, only after your consent and never on sign-in pages (see the Cookie Policy and Analytics rules). They are designed not to receive business personal data. None of them is live today, except Cloudflare's observability of our own services; this list is updated before any of them is switched on. Microsoft Clarity and PostHog are also planned and not live; we state no entity or terms for them until their accounts exist.
| Provider | Tool | Status |
|---|---|---|
| Cloudflare | Web Analytics, Zaraz, Workers observability | Observability on; the others planned |
| Google Analytics 4, Search Console | Planned | |
| Functional Software, Inc. | Sentry (an EU region in Frankfurt is available) | Planned |
3. Changes to this list
We authorize these sub-processors generally, and we may add or replace one. The process is:
- Notice. At least 30 days before a new sub-processor starts processing personal data, we email the owners of every business account, or tell them in the console, and update this page.
- Objection. If you have reasonable data protection grounds, you may object within that period by writing to privacy@avonao.com, as set out in the Data Processing Agreement. We then try in good faith to avoid using the new sub-processor for your data.
Our obligations to our sub-processors mirror our obligations to you, and we stay responsible for them.
4. Related
- Data Processing Agreement, including notice and objection.
- Privacy Policy, including international transfers.
- Cookie Policy, for the cookies and local storage we use.
- Questions and objections: privacy@avonao.com.
Avonao IDOne Avonao ID. Every platform. Your call.
Create your account in a minute with a passkey, then connect the platforms you use.
