Every company that touches data on our behalf, and what each one sees.
Last updated: 22 July 2026
This is the complete list. We update it before adding anyone new.
| Provider | What it does | What it sees | Where |
|---|---|---|---|
| DeepSeek | Judges and rewrites comment text | The comment text being assessed. No account details, no email address, nothing identifying you | China |
| Google Cloud | Runs our API | Requests in transit; usage counts. Diagnostic logs identify messages by hash, never by text | United Kingdom (London) |
| Supabase | Accounts, sign-in, database | Your email address, password hash, daily usage counts, subscription status | [SUPABASE REGION — check your project settings] |
| Cloudflare | Hosts this website; DNS | Standard web request data for wardensuite.com | Global edge network |
| Paddle | Payments, as merchant of record | Your name, billing address, payment details and purchase history. We never see your card details | United Kingdom / EU |
DeepSeek is the only subprocessor that sees the comment text, and it is outside the UK. That is inherent to how Warden works: the judging is done by a hosted AI model, and there is no configuration in which it happens on your own machine.
What DeepSeek receives is the message text alone. It is not told who you are, what page you were on, or which account made the request — those never leave our own service.
See the privacy policy for the transfer mechanism relied on for that transfer.
If we add or replace a subprocessor we will update this page, and email account holders where the change materially affects how data is handled.