To run Leaf, we rely on providers who process data on our behalf. They are bound by contract to protect it and to use it only for the service they provide us. This list covers our customers’ data and that of their visitors and users, for which Leaf is a processor.
The list
| Provider | What for | Data | Where | Transfer safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH (Germany) | The platform’s servers: dashboard, API, accounts, content, accounts of your sites’ users, form submissions, billing, building sites | All of the service’s data | Germany (EU) | No transfer |
| Cloudflare, Inc. (United States) | Serving sites and their code, files and images (R2), databases (D1), real time, domains and certificates, form anti-spam (Turnstile), visit statistics, protecting our addresses | What sites serve and store; visitors’ requests (IP address, browser) | Cloudflare’s global network | Data Privacy Framework, standard contractual clauses |
| Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., United States) | Paying for subscriptions and credits; payments in your apps (Stripe Connect) | Billing identity, VAT number, payment data (cards stay at Stripe), purchases | European Union, United States | Data Privacy Framework, standard contractual clauses |
| Resend (United States) | Sending emails: sign-in links, invitations, notices, emails of your sites’ accounts, form submissions | Email address, name, email content | United States | Data Privacy Framework or standard contractual clauses |
| Vercel Inc. (United States), AI Gateway | Routing your apps’ AI calls to the chosen model | Content of the calls (text, images) and answers | United States | Data Privacy Framework or standard contractual clauses |
| AI model providers, through Vercel (for example OpenAI, Anthropic, Google, Mistral, depending on the model your app calls) | Producing your apps’ AI answers | Content of the calls and answers | Depends on the provider | Vercel’s terms with each provider |
| Firecrawl (United States) | Reading a web page or running a search for an app that uses it | Page addresses, search terms | United States | Standard contractual clauses |
| Google (Google Ireland Ltd. and Google LLC) | Sign in with Google, on the dashboard and on sites that offer it; checking redirect links (Safe Browsing) | Name, email address, profile picture; checked addresses | European Union, United States | Data Privacy Framework |
What is not on it
The AI you use to build your projects (Claude, ChatGPT, Mistral or another) is chosen and contracted by you: it is not a Leaf provider. What you share with it falls under its provider’s terms.
An outside service your projects call themselves, with a secret you typed (your CRM, for example), is your choice and falls under your contract with it.
Changes
We update this page before entrusting data to a new provider. Customers who signed our data processing agreement are told in advance and may object, as that agreement provides. Questions: [email protected].