Legal
Subprocessors
Last updated: 17 September 2026
This list names the third parties that process personal data on Totomoko's behalf, what each one does, what it holds and where it processes it. It supports Article 6 of the Privacy Notice and any data processing agreement in force with a client. It is maintained as services change, and every addition is recorded here.
1. The list
1.1 Current subprocessors
| Entity | Purpose | Data | Location |
|---|---|---|---|
| Cal.com, Inc. | Scheduling the first conversation | Booking details: name, email, time zone, notes | United States |
| Cloudflare, Inc. | Hosting, content delivery and security for the site; cookieless aggregate analytics (Cloudflare Web Analytics) | Server and security logs; page views and performance metrics, not tied to an individual | United States; European Union |
| Google LLC | Website usage statistics (Google Analytics 4), loaded only after a visitor accepts the cookie banner | Pages viewed, device and browser type, approximate location from IP, and the _ga cookies described in the Cookies Notice |
United States |
| Microsoft Corporation | Session recordings and heatmaps (Microsoft Clarity), loaded only after a visitor accepts the cookie banner | Clicks, scrolling and mouse movement with form input masked, device and browser type, approximate location from IP, and the _clck/_clsk cookies described in the Cookies Notice; recordings kept 30 days |
United States |
| HubSpot, Inc. (HubSpot Ireland Ltd for EU accounts) | CRM: contact and ticket records from the site forms | Name, email, organization, role and message from the contact and newsletter forms; country from the request | European Union (EU data center) |
| Purelymail LLC | Email hosting for our mailboxes | Email sent to and from us | United States |
| Resend, Inc. | Email delivery for the newsletter and automated sequences (sends from news.totomoko.com), with open and click tracking | Email, name, country, organization, and open and click events | United States; sending from the European Union |
| Stripe, Inc. | Invoicing and payment processing for client engagements | Billing name, address, email and invoice records; card details never reach us | United States |
2. What a subprocessor is
2.1 Definition
A subprocessor is a third party engaged by Totomoko to process personal data in the course of providing the site or a client engagement. Each one acts on our instructions, under its own data processing terms, and has access only to the data its role needs.
2.2 Not on this list
Providers that receive no personal data from us, and services you use on their own domain before anything reaches us, are not subprocessors and are not listed here.
3. Engagements
3.1 Client work
A paid engagement may use additional providers, including AI model providers, chosen for that work. They are named in the engagement's data processing agreement before any personal data reaches them, and added here where they process data for more than one client.
4. Changes
4.1 Notice
This list changes as services are added or replaced. The date at the top tells you when it last moved. Clients with a data processing agreement in force are notified of additions under its terms, with the right to object set out there.
5. Contact
5.1 Questions
Questions about this list go to privacy@totomoko.com.