SpinUI Sub-processors
Last updated: 12 November 2026
SpinUI (Digiport OÜ) uses the sub-processors below to provide the Service. We give notice of a new or replacement sub-processor at least 30 days in advance, by updating this page and emailing the Admins of each organization, as described in the Data Processing Addendum, Section 6.
1. Sub-processors
| Name | Purpose | Data | Location |
|---|---|---|---|
| Microsoft Corporation (Microsoft Azure) | Hosting the web app (Container Apps), cloud test runners (Container Apps Jobs), database (Azure SQL), file storage for artifacts and test emails (Blob Storage), encryption keys and secrets (Key Vault), container images (Container Registry, no customer data), monitoring (Application Insights, Log Analytics), the test-email receiver (Linux VM) | All customer test content and account data; service telemetry tagged with organization ID | United States, Central US. Production database backups are geo-redundant in the paired region, East US 2 (United States). |
| Microsoft Corporation (Azure Communication Services Email) | Sending account, invitation, verification, password, billing and alert emails from notifications@spinui.com |
Recipient email address, name, email content (which may include run results for alerts) | United States |
| Cloudflare, Inc. | DNS for spinui.com, TLS termination, reverse proxy, web application firewall, DDoS protection, static asset caching, origin lock. Pages hosting and Web Analytics (cookieless, aggregated page views) for the public website spinui.com. Email Routing for SpinUI's own inbound addresses (for example support@spinui.com). Turnstile bot verification on account forms (sign-in, sign-up, password reset and email verification); Turnstile on the website contact form; Pages Functions, Workers and email sending to deliver contact-form messages to SpinUI's mailbox |
All web, API, runner and mail-receiver HTTPS traffic in transit; IP addresses; mail sent to SpinUI's routed addresses; browser and device signals (IP address, TLS fingerprint, User-Agent) for Turnstile; contact-form content (name, email address, topic, message) in transit | Global: traffic is handled at the Cloudflare location nearest to the visitor. Cloudflare, Inc. is based in the United States |
| Anthropic, PBC | AI model (Claude Haiku by default) for AI features, on plans that include them: suggested checks, failure explanations, summary polish, accessibility fix suggestions, Describe a test, suggested selector fixes, coverage suggestions | Minimised extracts only: step labels, URL paths (no host or query), page titles, headings and short text snippets, masked failure messages, masked HTML snippets, crawl page paths and titles, user-typed test descriptions. Typed field values only if an Admin opts in. Never screenshots, secrets, cookies or test emails | United States |
2. Independent providers (not sub-processors of customer test content)
| Name | Role | Data |
|---|---|---|
| Stripe (Managed Payments). Stripe acts as reseller and merchant of record through its affiliate Link, LLC, shown at checkout as "Sold through Link" | Sells paid plans as reseller and merchant of record. Handles payment, invoices, tax and refunds. Independent controller of payment data under its own privacy policy | Payment details, billing address, tax data, email. SpinUI receives customer and subscription identifiers, status and invoice references, but never full card numbers |
| Google LLC (Google sign-in) | Optional sign-in provider chosen by the user, where we offer it | Sign-in identifier, name, email (openid profile email) |
| Microsoft Corporation (Microsoft identity platform sign-in) | Optional sign-in provider chosen by the user, where we offer it (work, school or personal accounts) | Tenant and object identifier, name, email |
3. Not used, or customer-directed
- GitHub is used only for SpinUI's source code and CI. It does not process customer data, and there is no GitHub sign-in in the code. It is not listed above.
- No separate email-testing provider is used. Test emails go to SpinUI's own mail receiver in Azure.
- Destinations the customer chooses are under the customer's control and are not SpinUI sub-processors:
- Slack, Microsoft Teams, email recipients and webhooks;
- CI systems;
- private runners on the customer's own hosts;
- AI agents or coding assistants connected through MCP or the CLI.